nuke webkit security tests

- Tests are broken and needs whole re-write

Bug: 6950518
Bug: 6950487
Change-Id: I6e3ae169e10f9e83095e685fc6daeb84c2dd64b0
diff --git a/CtsTestCaseList.mk b/CtsTestCaseList.mk
index 60a8cf2..c93fafb 100644
--- a/CtsTestCaseList.mk
+++ b/CtsTestCaseList.mk
@@ -95,7 +95,6 @@
 	CtsUtilTestCases \
 	CtsViewTestCases \
 	CtsWebkitTestCases \
-	CtsWebkitSecurityTestCases \
 	CtsWidgetTestCases
 
 # All APKs that need to be scanned by the coverage utilities.
diff --git a/tests/tests/webkitsecurity/Android.mk b/tests/tests/webkitsecurity/Android.mk
deleted file mode 100644
index 424cbf36..0000000
--- a/tests/tests/webkitsecurity/Android.mk
+++ /dev/null
@@ -1,31 +0,0 @@
-# Copyright (C) 2012 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH:= $(call my-dir)
-
-include $(CLEAR_VARS)
-
-LOCAL_MODULE_TAGS := optional
-
-LOCAL_JAVA_LIBRARIES := android.test.runner
-
-LOCAL_SRC_FILES := $(call all-java-files-under, src)
-
-LOCAL_PACKAGE_NAME := CtsWebkitSecurityTestCases
-
-LOCAL_STATIC_JAVA_LIBRARIES := ctsutil ctstestserver ctstestrunner
-
-LOCAL_SDK_VERSION := current
-
-include $(BUILD_CTS_PACKAGE)
diff --git a/tests/tests/webkitsecurity/AndroidManifest.xml b/tests/tests/webkitsecurity/AndroidManifest.xml
deleted file mode 100644
index 706c51c..0000000
--- a/tests/tests/webkitsecurity/AndroidManifest.xml
+++ /dev/null
@@ -1,32 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!--
- * Copyright (C) 2012 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- -->
-
-<manifest xmlns:android="http://schemas.android.com/apk/res/android"
-    package="com.android.cts.webkitsecurity">
-
-    <uses-permission android:name="android.permission.DISABLE_KEYGUARD" />
-    <application>
-        <uses-library android:name="android.test.runner" />
-        <activity android:name="android.webkitsecurity.cts.WebViewStubActivity" />
-    </application>
-
-    <instrumentation android:name="android.test.InstrumentationCtsTestRunner"
-                     android:targetPackage="com.android.cts.webkitsecurity"
-                     android:label="CTS tests of android.webkitsecurity"/>
-
-</manifest>
-
diff --git a/tests/tests/webkitsecurity/assets/2d.text-custom-font-load-crash.html b/tests/tests/webkitsecurity/assets/2d.text-custom-font-load-crash.html
deleted file mode 100644
index c24b0cb..0000000
--- a/tests/tests/webkitsecurity/assets/2d.text-custom-font-load-crash.html
+++ /dev/null
@@ -1,33 +0,0 @@
-<!DOCTYPE html>

-<div>Test passes if it does not crash.</div>

-<script src="../tests.js"></script>

-<style>

-@font-face {

-font-family: CanvasTest; 

-  src: url("does_not_exist.ttf");

-}

-</style>

-<applet>

-<canvas id="c">

-</applet>

-<ul id="d"></ul>

-<script>

-if (window.layoutTestController)

-    layoutTestController.dumpAsText();

-

-_addTest(function(canvas, ctx) {

-

-ctx.fillRect(0, 0, 100, 50);

-ctx.font = '1px CanvasTest';

-ctx.fillText('AA', 0, 50);

-deferTest();

-

-setTimeout(wrapFunction(function () {

-    ctx.fillText('AA', 0, 50);

-

-    if (window.layoutTestController)

-        layoutTestController.notifyDone();

-}), 500);

-

-});

-</script>

diff --git a/tests/tests/webkitsecurity/assets/4145535Crash-expected.png b/tests/tests/webkitsecurity/assets/4145535Crash-expected.png
deleted file mode 100644
index dc14b60..0000000
--- a/tests/tests/webkitsecurity/assets/4145535Crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/4145535Crash.html b/tests/tests/webkitsecurity/assets/4145535Crash.html
deleted file mode 100644
index 3dfaf1f..0000000
--- a/tests/tests/webkitsecurity/assets/4145535Crash.html
+++ /dev/null
@@ -1,3 +0,0 @@
-<table
-CELLSPACING=8888888888>
-<EMBED UNITS="4">
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/5725058-crash-scenario-1.html b/tests/tests/webkitsecurity/assets/5725058-crash-scenario-1.html
deleted file mode 100644
index 19d08d7..0000000
--- a/tests/tests/webkitsecurity/assets/5725058-crash-scenario-1.html
+++ /dev/null
@@ -1,25 +0,0 @@
-<p>Test for (rdar://problem/5725058). If you see this text, then all is well and no crash has occurred.</p>
-
-<span>
-    <div name='test'></div>
-</span>
-<script type='text/javascript'>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    function triggerGarbageCollection()
-    {
-        if (window.GCController) {
-            GCController.collect();
-            return;
-        }
-        for (var i = 0; i < 10000; ++i)
-            ({})
-    }
-
-    document.getElementsByName('test')[0];
-    triggerGarbageCollection();
-    document.getElementsByTagName('span')[0].innerHTML = '';
-    triggerGarbageCollection();
-    document.getElementsByName('test')[0];
-</script>
diff --git a/tests/tests/webkitsecurity/assets/5725058-crash-scenario-2.html b/tests/tests/webkitsecurity/assets/5725058-crash-scenario-2.html
deleted file mode 100644
index 147b2df..0000000
--- a/tests/tests/webkitsecurity/assets/5725058-crash-scenario-2.html
+++ /dev/null
@@ -1,42 +0,0 @@
-<p>Test for (rdar://problem/5725058). If you see this text, then all is well and no crash has occurred.</p>
-
-<p id="a">paragraph a</p>
-<p id="b">paragraph b</p>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function triggerGarbageCollection()
-{
-    if (window.GCController) {
-        GCController.collect();
-        return;
-    }
-    for (var i = 0; i < 10000; ++i)
-        ({})
-}
-
-function setUp()
-{
-    // This only works if in a function. I'm not sure why.
-
-    // Get node and length from paragraph A into the cache.
-    document.getElementById("a").childNodes[0];
-    document.getElementById("a").childNodes.length;
-}
-
-setUp();
-
-// Get back to "zero node lists".
-triggerGarbageCollection();
-
-// Remove the child node of paragraph A. Use innerHTML to avoid getting a reference to the node being removed.
-document.getElementById("a").innerHTML = "";
-
-// Get back to "one node list".
-var childNodesB = document.getElementById("b").childNodes;
-
-// Now try the original list.
-var x = document.getElementById("a").childNodes[0];
-x = document.getElementById("a").childNodes.length;
-</script>
diff --git a/tests/tests/webkitsecurity/assets/5725058-crash-scenario-3.html b/tests/tests/webkitsecurity/assets/5725058-crash-scenario-3.html
deleted file mode 100644
index e3b8d61..0000000
--- a/tests/tests/webkitsecurity/assets/5725058-crash-scenario-3.html
+++ /dev/null
@@ -1,18 +0,0 @@
-<p>Test for (rdar://problem/5725058). If you see this text, then all is well and no crash has occurred.</p>
-
-<p id="a"><a name="anchor">paragraph a</a></p>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-var list = document.getElementsByName("anchor");
-var x = list.length
-x = list[0];
-
-// Remove the child node of paragraph A. Use innerHTML to avoid getting a reference to the node being removed.
-document.getElementById("a").innerHTML = "";
-
-// Now try the original list.
-x = list.length;
-x = list[0];
-</script>
diff --git a/tests/tests/webkitsecurity/assets/EmptyMFracCrash.xhtml b/tests/tests/webkitsecurity/assets/EmptyMFracCrash.xhtml
deleted file mode 100644
index 1bc3edf..0000000
--- a/tests/tests/webkitsecurity/assets/EmptyMFracCrash.xhtml
+++ /dev/null
@@ -1,17 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML" xml:lang="en">
-<head>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-</head>
-<body>
-    <math xmlns="http://www.w3.org/1998/Math/MathML"> 
-        <mtext>This test passes if it does not crash.</mtext>
-        <mrow> 
-            <mfrac></mfrac> 
-        </mrow> 
-    </math>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/EmptyMunderOverCrash.xhtml b/tests/tests/webkitsecurity/assets/EmptyMunderOverCrash.xhtml
deleted file mode 100644
index e897c8c..0000000
--- a/tests/tests/webkitsecurity/assets/EmptyMunderOverCrash.xhtml
+++ /dev/null
@@ -1,17 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML" xml:lang="en">
-<head>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-</head>
-<body>
-<math xmlns="http://www.w3.org/1998/Math/MathML"> 
-    <mtext>This test passes if it does not crash.</mtext> 
-    <mrow> 
-        <munderover></munderover> 
-    </mrow> 
-</math>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/NamedNodeMap-setNamedItem-crash.html b/tests/tests/webkitsecurity/assets/NamedNodeMap-setNamedItem-crash.html
deleted file mode 100644
index 0efda6f..0000000
--- a/tests/tests/webkitsecurity/assets/NamedNodeMap-setNamedItem-crash.html
+++ /dev/null
@@ -1,10 +0,0 @@
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    onload = function()
-    {
-        document.body.attributes.setNamedItem(null);
-    }
-</script>
-This passes if it does not crash.  (see https://bugs.webkit.org/show_bug.cgi?id=18958)
diff --git a/tests/tests/webkitsecurity/assets/Range-insertNode-crash.html b/tests/tests/webkitsecurity/assets/Range-insertNode-crash.html
deleted file mode 100644
index 72ccb0a..0000000
--- a/tests/tests/webkitsecurity/assets/Range-insertNode-crash.html
+++ /dev/null
@@ -1,29 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-    <script type="text/javascript">
-        function log(msg)
-        {
-            document.getElementById('console').appendChild(document.createTextNode(msg + '\n'));
-        }
-
-        function runTests()
-        {
-            if (window.layoutTestController)
-                layoutTestController.dumpAsText();
-
-            var r = document.createRange();
-            try {
-                r.insertNode(r);
-            } catch(e) {
-            }
-
-            log('PASS: No crash.');
-        }
-    </script>
-</head>
-<body onload="runTests();">
-    <p>This tests that we don't crash when passing null to Range.insertNode().  (rdar://problem/5488478)</p>
-    <pre id="console"></pre>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/SVGPolygonElement-baseVal-list-removal-crash.html b/tests/tests/webkitsecurity/assets/SVGPolygonElement-baseVal-list-removal-crash.html
deleted file mode 100644
index dd44f35..0000000
--- a/tests/tests/webkitsecurity/assets/SVGPolygonElement-baseVal-list-removal-crash.html
+++ /dev/null
@@ -1,20 +0,0 @@
-<html>
-<head>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function go() {
-    var oSVGPolygon = document.createElementNS("http://www.w3.org/2000/svg", "polygon");
-    var oSVGPath = document.createElementNS("http://www.w3.org/2000/svg", "path");
-    var oSVGPoint1 = oSVGPath.getPointAtLength();
-    oSVGPolygon.points.initialize(oSVGPoint1);
-    oSVGPolygon.points.removeItem(-9223372036854775802);
-    alert("Accessing old oSVGPoint1.x: " + oSVGPoint1.x);
-}
-</script>
-</head>
-<body onload="go()">
-This test passes if it doesn't crash.
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/SVGStyledElement-pendingResource-crash.html b/tests/tests/webkitsecurity/assets/SVGStyledElement-pendingResource-crash.html
deleted file mode 100755
index 816b4a2..0000000
--- a/tests/tests/webkitsecurity/assets/SVGStyledElement-pendingResource-crash.html
+++ /dev/null
@@ -1,20 +0,0 @@
-<!DOCTYPE html>
-<html >
-    <script>
-        function body_start() {
-            var q = document.getElementById('root').contentDocument;
-            q.getElementsByTagName('svg')[0].replaceChild(q.getElementById('refImage'), q.getElementById('d'));
-            q.getElementsByTagName('use')[0].setAttribute('xlink:href', '#testName');
-            if (window.layoutTestController) {
-                layoutTestController.dumpAsText();
-                layoutTestController.waitUntilDone();
-            }
-            setTimeout(function () {
-                    document.body.innerHTML = "PASS, if DumpRenderTree doesn't crash, and no assertion in a Debug build.";
-                    if (window.layoutTestController)
-                        layoutTestController.notifyDone();
-               }, 0);
-        }
-    </script>
-    <object data="resources/SVGStyledElement-pendingResource-crash.svg" id="root" onload="body_start();" type="image/svg+xml"/></object>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/SVGStyledElement-pendingResource-crash.svg b/tests/tests/webkitsecurity/assets/SVGStyledElement-pendingResource-crash.svg
deleted file mode 100755
index fcd5b2c..0000000
--- a/tests/tests/webkitsecurity/assets/SVGStyledElement-pendingResource-crash.svg
+++ /dev/null
@@ -1,14 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>

-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">

-	<image id="refImage"/>

-	<g>

-		<text id="testName">X</text>

-		<use xlink:href="#navigationGroup" />

-	</g>

-	<defs id="d">

-		<g id="navigationGroup" fill='url(#testName)'>

-			<a stroke='url(#refImage)'><text id="ABC">A</text></a>

-        </g>

-    </defs>

-</svg>

diff --git a/tests/tests/webkitsecurity/assets/abort-crash.html b/tests/tests/webkitsecurity/assets/abort-crash.html
deleted file mode 100644
index 2db7e74..0000000
--- a/tests/tests/webkitsecurity/assets/abort-crash.html
+++ /dev/null
@@ -1,39 +0,0 @@
-<html>
-<head>
-<script>
-    
-function f() {
-    var req = new XMLHttpRequest();
-    req.open("GET", "hello-world.cgi"); 
-    req.setRequestHeader("Cache-Control", "no-cache");
-    req.send(null);  
-    req.abort();
-}
-
-function runTest() {
-    if (window.layoutTestController) {
-        layoutTestController.waitUntilDone();
-        layoutTestController.dumpAsText();
-    }
-    
-    f();
-    
-    // create lots of objects to force a garbage collection
-    var i = 0;
-    var s;
-    while (i < 5000) {
-        i = i+1.11;
-        s = s + " ";
-    }
-     
-     // Add a small timeout to give the callbacks a chance to fire
-     if (window.layoutTestController)
-        setTimeout("layoutTestController.notifyDone()", 100)
-}         
-</script>
-</head>
-<body onload="runTest()">
-    This tests that aborting and then garbage collecting an XMLHttpRequest does not cause a crash.
-    SUCCESS! Didn't crash.
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/absolute-position-foreign-object-child-crash.html b/tests/tests/webkitsecurity/assets/absolute-position-foreign-object-child-crash.html
deleted file mode 100755
index 13123cf..0000000
--- a/tests/tests/webkitsecurity/assets/absolute-position-foreign-object-child-crash.html
+++ /dev/null
@@ -1,25 +0,0 @@
-<script src="../../fast/js/resources/js-test-pre.js"></script>
-
-<svg>
-    <foreignObject>
-        <div style="position: absolute;">
-            <div id="div1"></div>
-            <div id="div2" style="overflow:hidden; width:100px; height:100px;">x</div>
-        </div>
-    </foreignObject>
-</svg>
-<script>
-function RemoveNode(n) { n.parentNode.removeChild(n) }
-    window.onload = function() {
-        document.body.offsetTop; // Force layout.
-        RemoveNode(document.getElementById('div1'));
-        document.body.offsetTop; // Force layout.
-        RemoveNode(document.getElementById('div2'));
-        if (window.layoutTestController)
-            layoutTestController.dumpAsText();
-}
-</script>
-<body>
-    PASS
-</body>
-
diff --git a/tests/tests/webkitsecurity/assets/adopt-node-crash.html b/tests/tests/webkitsecurity/assets/adopt-node-crash.html
deleted file mode 100644
index 4413edd..0000000
--- a/tests/tests/webkitsecurity/assets/adopt-node-crash.html
+++ /dev/null
@@ -1,24 +0,0 @@
-<!DOCTYPE html>
-<div>Tests for a crash due to modifying the DOM during mutation events due to an adoptNode call. If this page doesn't crash and DOMSubtreeModified is fire, this test succeeds.</div>
-<div id="result"></div>
-<div id="node-to-adopt"></div>
-<iframe></iframe>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-var nodeToAdopt = document.getElementById('node-to-adopt');
-
-var mutationHandler = function() {
-    document.getElementById('result').innerHTML = "DOMSubtreeModified fired";
-    document.body.removeEventListener('DOMSubtreeModified', mutationHandler, true);
-    document.body.appendChild(nodeToAdopt);
-};
-document.body.addEventListener('DOMSubtreeModified', mutationHandler, true);
-
-var iframe = document.querySelector('iframe');
-var iframeDoc = iframe.contentDocument;
-iframeDoc.adoptNode(nodeToAdopt);
-// The crash happens when the iframe's document is getting detached.
-document.body.removeChild(iframe);
-</script>
diff --git a/tests/tests/webkitsecurity/assets/after-block-doesnt-crash.html-disabled b/tests/tests/webkitsecurity/assets/after-block-doesnt-crash.html-disabled
deleted file mode 100644
index 4184e17..0000000
--- a/tests/tests/webkitsecurity/assets/after-block-doesnt-crash.html-disabled
+++ /dev/null
@@ -1,23 +0,0 @@
-<meta http-equiv="refresh" content="1;url=" />
-<style>
-    ruby::after {
-        display: block;
-        content: url("http://yy");
-    }
-</style>
-<ruby>
-    <ruby>
-        <ruby>
-            <style>
-                ruby {
-                    float: right;	
-                }
-            </style>
-        </ruby>
-    </ruby>
-</ruby>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-This test passes if it doesn't crash.
diff --git a/tests/tests/webkitsecurity/assets/after-doesnt-crash.html b/tests/tests/webkitsecurity/assets/after-doesnt-crash.html
deleted file mode 100644
index 1eaf04f..0000000
--- a/tests/tests/webkitsecurity/assets/after-doesnt-crash.html
+++ /dev/null
@@ -1,22 +0,0 @@
-<html>
-  <head>
-    <style>
-      :after {
-        content: ""
-      }
-    </style>
-  </head>
-  <body onload="document.linkColor=0;">
-    <ruby>
-      <rt></rt>
-    </ruby>
-    <ruby style="float: left">
-      <rt></rt>
-    </ruby>
-    <script>
-      if (window.layoutTestController)
-          layoutTestController.dumpAsText();
-    </script>
-    This test passes if it doesn't crash.
-  </body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/after-table-doesnt-crash.html-disabled b/tests/tests/webkitsecurity/assets/after-table-doesnt-crash.html-disabled
deleted file mode 100644
index 5edf7f1..0000000
--- a/tests/tests/webkitsecurity/assets/after-table-doesnt-crash.html-disabled
+++ /dev/null
@@ -1,23 +0,0 @@
-<meta http-equiv="refresh" content="1;url=" />
-<style>
-    ruby::after {
-        display: table;
-        content: url("http://yy");
-    }
-</style>
-<ruby>
-    <ruby>
-        <ruby>
-            <style>
-                ruby {
-                    float: right;	
-                }
-            </style>
-        </ruby>
-    </ruby>
-</ruby>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-This test passes if it doesn't crash.
diff --git a/tests/tests/webkitsecurity/assets/after-with-first-letter-float-crash.html b/tests/tests/webkitsecurity/assets/after-with-first-letter-float-crash.html
deleted file mode 100755
index 6acc2d3..0000000
--- a/tests/tests/webkitsecurity/assets/after-with-first-letter-float-crash.html
+++ /dev/null
@@ -1,19 +0,0 @@
-<html>
-    <body>
-        <style type="text/css">
-            div::first-letter { float: right; content: "AB" }
-            div::after { display: table; content: "CD" }
-        </style>
-        <div></div>
-        PASS, if the script does not cause a crash or ASSERT failure
-        <script>
-            function runTest() {
-                document.body.offsetTop;
-                document.body.style.color = "blue";
-                if (window.layoutTestController)
-                    layoutTestController.dumpAsText();
-            }
-            window.onload = runTest;
-        </script>
-    </body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/anchor-linked-anonymous-block-crash.html b/tests/tests/webkitsecurity/assets/anchor-linked-anonymous-block-crash.html
deleted file mode 100644
index bdfc478..0000000
--- a/tests/tests/webkitsecurity/assets/anchor-linked-anonymous-block-crash.html
+++ /dev/null
@@ -1,8 +0,0 @@
-<html>

-Test passes if it does not crash.

-<script>

-    if (window.layoutTestController)

-        layoutTestController.dumpAsText();

-</script>

-<details>

-</html>

diff --git a/tests/tests/webkitsecurity/assets/animate-calcMode-spline-crash-bad-array-length.xhtml b/tests/tests/webkitsecurity/assets/animate-calcMode-spline-crash-bad-array-length.xhtml
deleted file mode 100755
index 9cb6ae4..0000000
--- a/tests/tests/webkitsecurity/assets/animate-calcMode-spline-crash-bad-array-length.xhtml
+++ /dev/null
@@ -1,30 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-    <body>
-        <svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
-            <path
-                d="m 65.912454,142.33657 c 32.971728,0.47546 54.353006,2.31459 71.732026,10.88083 17.37902,8.56625 34.29132,22.84947 51.25404,50.23341 13.77183,26.13619 16.30585,56.55141 24.4592,84.76493 10.69173,38.71495 20.90606,82.87651 67.29492,88.93182 41.52078,0.3788 52.41155,-41.57971 59.06828,-62.96039 6.46861,-20.7765 10.67334,-53.22798 17.38318,-74.37414 13.10483,-41.30006 19.81437,-45.96631 29.91229,-57.75202"
-                id="path_a"
-                style="fill:none;stroke:none;stroke-width:0.2;marker-mid:none;marker-end:none" />
-
-                <circle id="mycircle" cx="0" cy="0" r="12" >
-                    <animateMotion id="A" dur="2s" keyTimes="0; 0.6; 1"
-                        calcMode="spline" keySplines="1 0 1 0;0 1 0 1;"
-                        repeatCount="1" rotate="auto" fill="freeze">
-                            <mpath xlink:href="#path_a" />
-                    </animateMotion>
-                </circle>
-            </svg>
-        <script>
-            if (window.layoutTestController) {
-                layoutTestController.dumpAsText();
-                layoutTestController.waitUntilDone();
-	    }
-            setTimeout(function () {
-                    document.body.innerHTML = "PASS, if DumpRenderTree doesn't crash, and no assertion in a Debug build.";
-                    if (window.layoutTestController)
-                        layoutTestController.notifyDone();
-                }, 0);
-
-        </script>
-    </body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/animate-update-crash.xhtml b/tests/tests/webkitsecurity/assets/animate-update-crash.xhtml
deleted file mode 100644
index 3729bf3..0000000
--- a/tests/tests/webkitsecurity/assets/animate-update-crash.xhtml
+++ /dev/null
@@ -1,20 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">

-    <body>

-        <svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">

-            <text>

-                PASS

-                <textPath>

-                    <tref xlink:href="#foo">

-                        <animateColor attributeName="keyPoints"></animateColor>

-                        <animateColor attributeName="xlink:href"></animateColor>

-                    </tref>

-                </textPath>

-            </text>

-        </svg>

-        <script>

-            if (window.layoutTestController)

-                layoutTestController.dumpAsText();

-        </script>

-    </body>

-</html>

-

diff --git a/tests/tests/webkitsecurity/assets/animate-use-crash.xhtml b/tests/tests/webkitsecurity/assets/animate-use-crash.xhtml
deleted file mode 100644
index 46ca4ae..0000000
--- a/tests/tests/webkitsecurity/assets/animate-use-crash.xhtml
+++ /dev/null
@@ -1,16 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">

-    <g>

-        <defs> 

-            <text id="text">

-                <a onmousedown="">

-                    <animateTransform attributeName="a" end=",1"></animateTransform>

-                </a>Passes if doesn't crash     

-            </text>

-        </defs> 

-        <use x="25" y="25" xlink:href="#text"/>

-        <script><![CDATA[

-        if (window.layoutTestController)

-            layoutTestController.dumpAsText();

-        ]]></script>

-    </g>

-</svg>

diff --git a/tests/tests/webkitsecurity/assets/animated-background-image-crash.html b/tests/tests/webkitsecurity/assets/animated-background-image-crash.html
deleted file mode 100644
index 2f92319..0000000
--- a/tests/tests/webkitsecurity/assets/animated-background-image-crash.html
+++ /dev/null
@@ -1,48 +0,0 @@
-<html>
-<head>
-    <title></title>
-    <style>
-        div {
-            width: 40px;
-            height: 40px;
-            background: url(resources/animated.gif) top left no-repeat,
-                        url(resources/animated2.gif) bottom right no-repeat;
-        }
-    </style>
-    <script>
-        function step2()
-        {
-            if (window.layoutTestController)
-                layoutTestController.notifyDone();
-        }
-
-        function step1()
-        {
-            if (window.layoutTestController)
-                layoutTestController.display();
-            document.getElementById("target").style.display="none";
-            document.body.offsetTop;
-            setTimeout("step2()", 200);
-        }
-
-        function test()
-        {
-            if (window.layoutTestController) {
-                layoutTestController.dumpAsText();
-                layoutTestController.waitUntilDone();
-            }
-            setTimeout("step1()", 100);
-        }
-    </script>
-</head>
-<body onload="test()">
-    <p>
-        Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=12487">http://bugs.webkit.org/show_bug.cgi?id=12487</a>
-        REGRESSION: Repro crash when a second background image is animated</i>.
-    </p>
-    <p>
-        This test should not make Safari crash.
-    </p>
-    <div id="target"></div>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/animation-on-inline-crash.html b/tests/tests/webkitsecurity/assets/animation-on-inline-crash.html
deleted file mode 100644
index ef10914..0000000
--- a/tests/tests/webkitsecurity/assets/animation-on-inline-crash.html
+++ /dev/null
@@ -1,27 +0,0 @@
-<style>
-    .box {
-      position: relative; 
-      -webkit-animation-delay: 5ms;
-      -webkit-animation-name: anim;
-    }
-    @-webkit-keyframes anim {
-      from { -webkit-transform: translateX(10px); }
-    }
-</style>
-<script type="text/javascript" charset="utf-8">
-    if (window.layoutTestController) {
-        layoutTestController.dumpAsText();
-        layoutTestController.waitUntilDone();
-    }
-    
-    function waitForAnimation()
-    {
-        window.setTimeout(function() {
-            if (window.layoutTestController)
-                layoutTestController.notifyDone();
-        }, 50);
-    }
-    window.addEventListener('load', waitForAnimation, false);
-</script>
-<p>Test passes if it does not crash.</p>
-<span class="box">Hello world</span>
diff --git a/tests/tests/webkitsecurity/assets/anonymous-before-child-parent-crash-expected.png b/tests/tests/webkitsecurity/assets/anonymous-before-child-parent-crash-expected.png
deleted file mode 100644
index e3aef79..0000000
--- a/tests/tests/webkitsecurity/assets/anonymous-before-child-parent-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/anonymous-before-child-parent-crash.html b/tests/tests/webkitsecurity/assets/anonymous-before-child-parent-crash.html
deleted file mode 100644
index c4720fc..0000000
--- a/tests/tests/webkitsecurity/assets/anonymous-before-child-parent-crash.html
+++ /dev/null
@@ -1,31 +0,0 @@
-<html>

-<style>

-div { 

-    border: 5px solid maroon;

-    -webkit-column-count: 2;

-    width: 750px;

-    margin: 1em 0;

-}

-span { 

-    display: block;

-    margin: 1em 0;

-}

-h2 { 

-    -webkit-column-span: all;

-    background-color: #eeeeee;

-    color: black;

-}

-</style>

-<h2 id="base">PASS</h2>

-<div>

-<span id="one">

-Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Nulla varius enim ac mi. Curabitur sollicitudin felis quis lectus. Quisque adipiscing rhoncus sem. Proin nulla purus, vulputate vel, varius ut, euismod et, nisi. Sed vitae felis vel orci sagittis aliquam. Cras convallis adipiscing sem. Nam nonummy enim. Nullam bibendum lobortis neque. Vestibulum velit orci, tempus euismod, pretium quis, interdum vitae, nulla. Phasellus eget ante et tortor condimentum vestibulum.

-Suspendisse hendrerit quam nec felis. Sed varius turpis vitae pede. Lorem ipsum dolor sit amet, consectetuer adipiscing elit.<dl>

-</span>

-</div>

-<script>

-    one.insertBefore(document.getElementById('base').cloneNode(true), one.firstChild);

-    document.body.offsetTop;

-</script>

-</html>

-

diff --git a/tests/tests/webkitsecurity/assets/anonymous-block-crash.html b/tests/tests/webkitsecurity/assets/anonymous-block-crash.html
deleted file mode 100644
index ff6ce54..0000000
--- a/tests/tests/webkitsecurity/assets/anonymous-block-crash.html
+++ /dev/null
@@ -1,32 +0,0 @@
-<!DOCTYPE html>

-<html>

-  <body>

-  This test verifies that no crash occurs.

-    <font>

-      <div>

-        <table>

-          <tbody>

-            <tr>

-              <td>

-                <b>

-                  <font>

-                  <p>

-                  </font>

-                </b>

-              </td>

-            </tr>

-            </tbody>

-        </table>

-      <script>

-        var i = document.body.offsetTop;    // this forces a layout

-      </script>

-    </font>

-    <div id="console"></div>

-  </body>

-<script>

-if (window.layoutTestController)

-    layoutTestController.dumpAsText();

-document.getElementById("console").appendChild(document.createTextNode("PASS"));;

-</script>

-</html>

-

diff --git a/tests/tests/webkitsecurity/assets/anonymous-block-merge-crash.html b/tests/tests/webkitsecurity/assets/anonymous-block-merge-crash.html
deleted file mode 100644
index 94c3e8a..0000000
--- a/tests/tests/webkitsecurity/assets/anonymous-block-merge-crash.html
+++ /dev/null
@@ -1,16 +0,0 @@
-<span><object><div>PASS</div></span>
-<script src="full-screen-test.js"></script>
-<script>
-  if (Element.prototype.webkitRequestFullScreen == undefined) {
-  } else {
-    var span = document.getElementsByTagName('span')[0];
-
-    document.onwebkitfullscreenchange = function(event) {
-      document.body.appendChild(document.createElement('div'));
-      document.webkitCancelFullScreen();
-      layoutTestController.notifyDone();
-    };
-
-    runWithKeyDown(function(){span.webkitRequestFullScreen()});
-  }
-</script>
diff --git a/tests/tests/webkitsecurity/assets/anonymous-render-block-in-continuation-causes-crash.html b/tests/tests/webkitsecurity/assets/anonymous-render-block-in-continuation-causes-crash.html
deleted file mode 100644
index fea7be3..0000000
--- a/tests/tests/webkitsecurity/assets/anonymous-render-block-in-continuation-causes-crash.html
+++ /dev/null
@@ -1,43 +0,0 @@
-<html>
-<head>
-<link rel="stylesheet" href="../fast/js/resources/js-test-style.css">
-<script src="../fast/js/resources/js-test-pre.js"></script>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.waitUntilDone();
-
-    function walkAccessibilityTree(accessibilityObject) {
-        var count = accessibilityObject.childrenCount;
-        for (var i = 0; i < count; ++i)
-            walkAccessibilityTree(accessibilityObject.childAtIndex(i));
-    }
-
-    function runTest() {
-        description("This tests that having an anonymous render block in a continuation doesn't cause a crash when walking the accessibility tree.");
-
-        window.root = accessibilityController.rootElement;
-        walkAccessibilityTree(root);
-
-        debug('<br /><span class="pass">TEST COMPLETE</span>');
-        if (window.layoutTestController)
-            layoutTestController.notifyDone();
-    }
-
-    if (window.layoutTestController && window.accessibilityController) {
-        window.addEventListener('load', function() {
-            setTimeout(runTest, 10);
-        }, false);
-    }
-</script>
-</head>
-<body>
-
-<li><span>x<ul><li>y</ul></span>z</li>
-
-End of test.
-
-<p id="description"></p>
-<div id="console"></div>
-
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/anonymous-split-block-crash-expected.png b/tests/tests/webkitsecurity/assets/anonymous-split-block-crash-expected.png
deleted file mode 100644
index da119c7..0000000
--- a/tests/tests/webkitsecurity/assets/anonymous-split-block-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/anonymous-split-block-crash.html b/tests/tests/webkitsecurity/assets/anonymous-split-block-crash.html
deleted file mode 100644
index 994a4c6..0000000
--- a/tests/tests/webkitsecurity/assets/anonymous-split-block-crash.html
+++ /dev/null
@@ -1,21 +0,0 @@
-<html>

-<style>

-div { 

-    border: 5px solid maroon; 

-    -webkit-column-count: 2;

-    margin: 1em 0;

-}

-h2 { 

-    -webkit-column-span: all;

-    background-color: #eeeeee;

-    color: black;

-}

-</style>

-<div>

-<junk>

-<h2>PASS</h2>

-Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Nulla varius enim ac mi. Curabitur sollicitudin felis quis lectus. Quisque adipiscing rhoncus sem. Proin nulla purus, vulputate vel, varius ut, euismod et, nisi. Sed vitae felis vel orci sagittis aliquam. Cras convallis adipiscing sem. Nam nonummy enim. Nullam bibendum lobortis neque. Vestibulum velit orci, tempus euismod, pretium quis, interdum vitae, nulla. Phasellus eget ante et tortor condimentum vestibulum.

-Suspendisse hendrerit quam nec felis. Sed varius turpis vitae pede. Lorem ipsum dolor sit amet, consectetuer adipiscing elit.

-</div>

-</html>

-

diff --git a/tests/tests/webkitsecurity/assets/apply-style-text-decoration-crash.html b/tests/tests/webkitsecurity/assets/apply-style-text-decoration-crash.html
deleted file mode 100644
index a3d00ea..0000000
--- a/tests/tests/webkitsecurity/assets/apply-style-text-decoration-crash.html
+++ /dev/null
@@ -1,20 +0,0 @@
-<html>

-    <script>

-        function runTest() 

-        {

-            if (window.layoutTestController)

-                layoutTestController.dumpAsText();

-

-            window.getSelection().setBaseAndExtent(start, 0, null, 0);

-            document.execCommand("Indent");

-            document.getElementById("result").innerHTML = "PASS";

-        }

-    </script>

-    <body onLoad="runTest();">

-        <p id="result"></p>

-        <div contenteditable="true" id="start" style="text-decoration: none;">

-            <hr style="text-align: right;"/>

-        </div>

-    </body>

-</html>

-

diff --git a/tests/tests/webkitsecurity/assets/applyblockelement-visiblepositionforindex-crash.html b/tests/tests/webkitsecurity/assets/applyblockelement-visiblepositionforindex-crash.html
deleted file mode 100644
index bbc0e77..0000000
--- a/tests/tests/webkitsecurity/assets/applyblockelement-visiblepositionforindex-crash.html
+++ /dev/null
@@ -1,24 +0,0 @@
-<script>
-
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function runTest() {
-    window.getSelection().setBaseAndExtent(start, 0, null, 0);
-    document.execCommand("Indent");
-    document.body.innerHTML = "PASS. WebKit didn't crash.";
-}
-</script>
-<body onload="runTest();">
-  <defs contenteditable="true" id="start">
-  <rt id="rt">A
-
-<script>
-document.write("text");
-try {
-    elem = document.getElementById("rt");
-    var new_elem = document.createElement("ruby");
-    new_elem.innerHTML = elem.innerHTML;
-    elem.parentNode.insertBefore(new_elem, elem);
-} catch (e) {}
-</script>
diff --git a/tests/tests/webkitsecurity/assets/arc-crash.html b/tests/tests/webkitsecurity/assets/arc-crash.html
deleted file mode 100644
index f17a3e6..0000000
--- a/tests/tests/webkitsecurity/assets/arc-crash.html
+++ /dev/null
@@ -1,45 +0,0 @@
-<html>
-<head>
-<script type="text/javascript">
-function debug(str) {
-    var c = document.getElementById('console')
-    c.appendChild(document.createTextNode(str + '\n'));
-}
-
-function runTests() {
-    debug("This tests that we don't crash when passing inf as a parameter to arc");
-    var canvas = document.getElementById("test");
-    var context = canvas.getContext("2d");
-    context.fillStyle = '#f00';
-    context.fillRect(0, 0, canvas.width, canvas.height);
-    try {
-        context.arc(10, 10, 20, 20, 1.0/0.0, true);
-        context.arc(10, 10, 20, 20, 1.0/0.0, true);
-        context.arc(10, 10, 1.0/0.0, 20, 20, true);
-        context.arc(10, 10, 20, 1.0/0.0, 20, true);
-        context.arc(10, 1.0/0.0, 10, 20, 20, true);
-        context.arc(1.0/0.0, 10, 10, 20, 20, true);
-        context.arc(10, 10, 20, 20, 1.0/0.0, false);
-        context.arc(10, 10, 1.0/0.0, 20, 20, false);
-        context.arc(10, 10, 20, 1.0/0.0, 20, false);
-        context.arc(10, 1.0/0.0, 10, 20, 20, false);
-        context.arc(1.0/0.0, 10, 10, 20, 20, false);
-    } catch (e) {
-    }
-    context.fillStyle = '#0f0';
-    context.fillRect(0, 0, canvas.width, canvas.height);
-    debug("Test passed.");
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-}
-</script>
-<title>borkedness</title>
-</head>
-<body>
-   <canvas id="test" width="100" height="100"></canvas><br />
-   <pre id="console"></pre>
-   <script>
-   runTests();
-   </script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/area-islink-focus-null-ptr-crash.html b/tests/tests/webkitsecurity/assets/area-islink-focus-null-ptr-crash.html
deleted file mode 100644
index c8555ea..0000000
--- a/tests/tests/webkitsecurity/assets/area-islink-focus-null-ptr-crash.html
+++ /dev/null
@@ -1,14 +0,0 @@
-<!--
-  http://code.google.com/p/chromium/issues/detail?id=73650
-  https://bugs.webkit.org/show_bug.cgi?id=54877
--->
-<div id="log">FAIL</div>
-<script>
-  window.layoutTestController && layoutTestController.dumpAsText();
-
-  oArea = document.createElement('area');
-  oArea.href = 0;
-  oArea.focus();
-
-  log.innerHTML = "PASS";
-</script>
diff --git a/tests/tests/webkitsecurity/assets/aria-activedescendant-crash.html b/tests/tests/webkitsecurity/assets/aria-activedescendant-crash.html
deleted file mode 100644
index 47e28ad..0000000
--- a/tests/tests/webkitsecurity/assets/aria-activedescendant-crash.html
+++ /dev/null
@@ -1,20 +0,0 @@
-<html>
-    <head>
-        <script>
-            function test()
-            {
-                if (window.layoutTestController)
-                    layoutTestController.dumpAsText();
-                document.getElementById('bt').focus();
-                if (window.accessibilityController)
-                    var test = accessibilityController.focusedElement.stringAttributeValue("aria-activedescendant");
-                document.getElementById('bt').click();
-            }
-        </script>
-    </head>
-    <body onload="test()">
-        This tests that there is no crash if you set an aria-activedescendant attribute to an id of an element that has no renderer.<br>
-        <input type="button" id="bt" onclick="this.setAttribute('aria-activedescendant', 'hiddenElement')" value="Use VoiceOver to activate this button, and then navigate to the next element">
-        <div id="hiddenElement" style="display:none"></div>
-    </body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/aria-options-and-menuitems-crash.html b/tests/tests/webkitsecurity/assets/aria-options-and-menuitems-crash.html
deleted file mode 100644
index 2a95ee2..0000000
--- a/tests/tests/webkitsecurity/assets/aria-options-and-menuitems-crash.html
+++ /dev/null
@@ -1,31 +0,0 @@
-<html>
-<head>
-<script src="../../../fast/js/resources/js-test-pre.js"></script>
-</head>
-<body id="body">
-<div role="menuitem">An ARIA menu item</div>
-<div role="option">An ARIA option</div>
-<p id="description"></p>
-<div id="console"></div>
-<script>
-description("This tests that having elements with ARIA role 'option' or 'menuitem' as children of something of Group role does not crash.");
-
-if (window.layoutController) {
-    layoutTestController.dumpAsText();
-}
-
-if (window.accessibilityController) {
-    document.getElementById("body").focus();
-    webArea = accessibilityController.focusedElement;
-
-    // Just trying to get the accessible objects for the elements with
-    // role 'option' and 'menuitem' shouldn't make this crash.
-    element = webArea.childAtIndex(0);
-    element = webArea.childAtIndex(1);
-}
-
-</script>
-<script src="../../../fast/js/resources/js-test-post.js"></script>
-</body>
-</html>
-
diff --git a/tests/tests/webkitsecurity/assets/array-buffer-crash.html b/tests/tests/webkitsecurity/assets/array-buffer-crash.html
deleted file mode 100644
index 7bdfb85..0000000
--- a/tests/tests/webkitsecurity/assets/array-buffer-crash.html
+++ /dev/null
@@ -1,26 +0,0 @@
-<html>
-<head>
-<script src="../../js/resources/js-test-pre.js"></script>
-<script src="resources/webgl-test.js"></script>
-</head>
-<body>
-<div id="description"></div>
-<div id="console"></div>
-
-<script>
-
-description('Test ArrayBuffer.byteLength');
-
-<!-- The following used to cause a crash in Chrome -->
-new ArrayBuffer().byteLength;
-
-testPassed("new ArrayBuffer().byteLength did not crash");
-
-</script>
-<script src="../../js/resources/js-test-post.js"></script>
-
-<script>
-</script>
-
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/array-buffer-view-crash-when-reassigned.html b/tests/tests/webkitsecurity/assets/array-buffer-view-crash-when-reassigned.html
deleted file mode 100644
index 84fb8c8..0000000
--- a/tests/tests/webkitsecurity/assets/array-buffer-view-crash-when-reassigned.html
+++ /dev/null
@@ -1,32 +0,0 @@
-<html>
-<head>
-<script src="../../js/resources/js-test-pre.js"></script>
-<script src="resources/webgl-test.js"></script>
-</head>
-<body>
-<div id="description"></div>
-<div id="console"></div>
-
-<script>
-
-description('Verify that reassigning typed array constructor does not crash.');
-
-<!-- The following used to cause a crash in Chrome -->
-Uint8Array = 0;
-Uint16Array = "string";
-Uint32Array = function() {};
-Int16Array = function() {};
-Int16Array.prototype.set = 0;
-new Float64Array(function () {});
-new Float32Array([1, 2, 3], 1);
-new Int16Array(function() {});
-testPassed("reassigning typed array constructor did not crash");
-
-</script>
-<script src="../../js/resources/js-test-post.js"></script>
-
-<script>
-</script>
-
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/array-buffer-view-crash.html b/tests/tests/webkitsecurity/assets/array-buffer-view-crash.html
deleted file mode 100644
index c0690a2..0000000
--- a/tests/tests/webkitsecurity/assets/array-buffer-view-crash.html
+++ /dev/null
@@ -1,26 +0,0 @@
-<html>
-<head>
-<script src="../../js/resources/js-test-pre.js"></script>
-<script src="resources/webgl-test.js"></script>
-</head>
-<body>
-<div id="description"></div>
-<div id="console"></div>
-
-<script>
-
-description('Verify that constructing a typed array view with no arguments and fetching its length does not crash');
-
-<!-- The following used to cause a crash in both Safari and Chrome -->
-new Uint32Array().length;
-
-testPassed("new Uint32Array().length did not crash");
-
-</script>
-<script src="../../js/resources/js-test-post.js"></script>
-
-<script>
-</script>
-
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/asterisk-counter-update-after-layout-crash.html b/tests/tests/webkitsecurity/assets/asterisk-counter-update-after-layout-crash.html
deleted file mode 100644
index 6fdb445..0000000
--- a/tests/tests/webkitsecurity/assets/asterisk-counter-update-after-layout-crash.html
+++ /dev/null
@@ -1,19 +0,0 @@
-<style>
-.x:after { content:counter(c, asterisks) ""; counter-increment:c 1550; }
-</style>
-<script>
-function runTest() {
-    document.styleSheets[0].insertRule("div { counter-reset: c 141170 }");
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-}
-window.onload=runTest;
-</script>
-<div>
-    <span class="x">
-    <div></div>
-    <span class="x">
-    <p>
-    <p>
-    PASS if no assert or crash in debug
-</div>
diff --git a/tests/tests/webkitsecurity/assets/avl-crash.html b/tests/tests/webkitsecurity/assets/avl-crash.html
deleted file mode 100644
index ecf61b9..0000000
--- a/tests/tests/webkitsecurity/assets/avl-crash.html
+++ /dev/null
@@ -1,10 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="script-tests/avl-crash.js"></script>
-<script src="resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/avl-crash.js b/tests/tests/webkitsecurity/assets/avl-crash.js
deleted file mode 100644
index fc9dea5..0000000
--- a/tests/tests/webkitsecurity/assets/avl-crash.js
+++ /dev/null
@@ -1,98 +0,0 @@
-description(
-"This test checks for a crash in sort() that was seen on a particular input data set."
-);
-
-function natcompare(a, b) {
-    if (a == b)
-        return 0;
-    return (a < b) ? -1 : 1;
-}
-
-SubwayData = [
-"23rd St-Broadway ", 
-"45 Road-Court Sq", 
-"LIC-Court Sq", 
-"LIC-Court Sq", 
-"23rd St-Park Ave S", 
-"241st St", 
-"242nd St", 
-"25th Ave", 
-"25th St", 
-"28th St-7th Ave", 
-"28th St-Broadway", 
-"28th St-Park Ave S", 
-"2nd Ave-Houston St", 
-"30th Ave", 
-"33rd St", 
-"33rd St-Park Ave", 
-"34th St-6th Ave", 
-"34th St-7th Ave", 
-"34th St-8th Ave", 
-"36th Ave", 
-"36th St", 
-"36th St", 
-"39th Ave", 
-"3rd Ave-138th St", 
-"3rd Ave-149th St", 
-"3rd Ave-14th St", 
-"40th St", 
-"42nd St-5th Ave-6th Ave", 
-"42nd St-5th Ave-6th Ave", 
-"45th St", 
-"46th St", 
-"46th St", 
-"47-50th Sts-Rockefeller Center", 
-"49th St-7th Ave", 
-"50th St-New Utrecht Ave", 
-"9th Ave", 
-"90th St-Elmhurst Ave", 
-"96th St", 
-"96th St", 
-"96th St", 
-"9th St-4th Ave", 
-"Alabama Ave", 
-"Allerton Ave", 
-"Aqueduct-North Conduit Ave", 
-"Astor Place", 
-"Astoria Blvd", 
-"Atlantic Ave", 
-"Atlantic Ave-Pacific St", 
-"Ave H", 
-"Ave N", 
-"Ave P", 
-"Ave U", 
-"Ave U", 
-"Ave U", 
-"Ave X", 
-"Bay Pkwy", 
-"Bay Pkwy", 
-"Bay Pkwy-22nd Ave", 
-"Bay Ridge Ave", 
-"Baychester Ave", 
-"Beach 105th St", 
-"Beach 25th St", 
-"Beach 36th St", 
-"Beach 44th St", 
-"Beach 60th St", 
-"Beach 67th St", 
-"Beach 90th St", 
-"Beach 98th St", 
-"Bedford Ave", 
-"Bedford Park Blvd", 
-"Broadway", 
-"Broadway", 
-"Bronx Park East", 
-"Brook Ave", 
-"Buhre Ave", 
-"Burke Ave", 
-"Burnside Ave", 
-"Bushwick Ave", 
-"Uptown Bleecker St-Lafayette St", 
-"Downtown Bleecker St-Lafayette St", 
-"Canal Street", 
-"Canal Street", 
-"Canal Street", 
-"Canal-Church Sts"
-];
-
-SubwayData.sort(natcompare)
diff --git a/tests/tests/webkitsecurity/assets/backcolor-crash.html b/tests/tests/webkitsecurity/assets/backcolor-crash.html
deleted file mode 100644
index aa2f4d5..0000000
--- a/tests/tests/webkitsecurity/assets/backcolor-crash.html
+++ /dev/null
@@ -1,16 +0,0 @@
-<html>
-<body>
-This is a crash test when executing backColor on a node where all of its ancestors have transparent background color.  You should see PASS at the end.
-<div id="test" contenteditable></div>
-<script>
-
-if (window.layoutTestController)
-    window.layoutTestController.dumpAsText();
-
-window.getSelection().setPosition(test, 0);
-var color = document.queryCommandValue('backColor', false, null);
-
-document.write('backColor: ' + color + '<br>');
-document.write('PASS');
-</script>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/background-fill-zero-area-crash.html b/tests/tests/webkitsecurity/assets/background-fill-zero-area-crash.html
deleted file mode 100644
index bd7a580..0000000
--- a/tests/tests/webkitsecurity/assets/background-fill-zero-area-crash.html
+++ /dev/null
@@ -1,50 +0,0 @@
-<!DOCTYPE html>
-<html>
-    <head>
-        <script>
-            if (window.layoutTestController)
-            layoutTestController.dumpAsText();
-        </script>
-        <style>
-            #a {
-                background-image: -webkit-gradient(linear, left top, left bottom, from(white), to(black));
-                -webkit-background-size: auto 50px;
-                -webkit-box-sizing: border-box;
-                border: 1px solid black;
-                width: 100px;
-                height: 2px;
-            }
-            #b {
-                background-image: -webkit-gradient(linear, left top, left bottom, from(white), to(black));
-                -webkit-background-size: 50px auto;
-                -webkit-box-sizing: border-box;
-                border: 1px solid black;
-                width: 2px;
-                height: 100px;
-            }
-            #c {
-                background-image: -webkit-gradient(linear, left top, left bottom, from(white), to(black));
-                -webkit-background-size: contain;
-                -webkit-box-sizing: border-box;
-                border: 1px solid black;
-                width: 2px;
-                height: 100px;
-            }
-            #d {
-                background-image: -webkit-gradient(linear, left top, left bottom, from(white), to(black));
-                -webkit-background-size: contain;
-                -webkit-box-sizing: border-box;
-                border: 1px solid black;
-                width: 100px;
-                height: 2px;
-            }
-        </style>
-    </head>
-    <body>
-        <p>Test of some edge cases for background fills with generated images. Test passed if it rendered and there was no division by zero.</p>
-        <div id="a"></div>
-        <div id="b"></div>
-        <div id="c"></div>
-        <div id="d"></div>
-    </body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/background-norepeat-crash.html b/tests/tests/webkitsecurity/assets/background-norepeat-crash.html
deleted file mode 100644
index 1ba2c5a..0000000
--- a/tests/tests/webkitsecurity/assets/background-norepeat-crash.html
+++ /dev/null
@@ -1,15 +0,0 @@
-<html>
-<head>
-    <title></title>
-    <script>
-        if (window.layoutTestController)
-            layoutTestController.dumpAsText();
-    </script>
-</head>
-<body style="background:url(),url(); background-repeat:no-repeat;">
-    <script>document.body.style.getPropertyValue("background")</script>
-    <p>
-        Test for crash when retrieving the implicit "background" property value with "background-repeat: no-repeat" (https://bugs.webkit.org/show_bug.cgi?id=49055). If this text appears, the test has passed.
-    </p>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/backward-textiterator-first-letter-crash.html b/tests/tests/webkitsecurity/assets/backward-textiterator-first-letter-crash.html
deleted file mode 100644
index eef2489..0000000
--- a/tests/tests/webkitsecurity/assets/backward-textiterator-first-letter-crash.html
+++ /dev/null
@@ -1,15 +0,0 @@
-<style>
-div:first-letter { margin-top: 0em; }
-</style>
-<script>
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-}
-function done() {
-    document.body.innerHTML = 'PASS if WebKit did not hit assertions';
-    if (window.layoutTestController)
-        layoutTestController.notifyDone();
-}
-</script>
-<body onload="setTimeout(done, 100);"><div>AB<select autofocus contenteditable>
diff --git a/tests/tests/webkitsecurity/assets/bad-handshake-crash.html b/tests/tests/webkitsecurity/assets/bad-handshake-crash.html
deleted file mode 100644
index 062a69c..0000000
--- a/tests/tests/webkitsecurity/assets/bad-handshake-crash.html
+++ /dev/null
@@ -1,28 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../../../js-test-resources/js-test-pre.js"></script>
-</head>
-<body>
-<div id="description"></div>
-<div id="console"></div>
-<script type="text/javascript">
-description("Make sure WebSocket doesn't crash with bad handshake message.");
-
-window.jsTestIsAsync = true;
-if (window.layoutTestController)
-    layoutTestController.overridePreference("WebKitHixie76WebSocketProtocolEnabled", 0);
-
-var ws = new WebSocket("ws://127.0.0.1:8880/websocket/tests/hybi/bad-handshake-crash");
-ws.onopen = function () {
-    debug("WebSocket is open");
-};
-ws.onclose = function () {
-    debug("WebSocket is closed");
-    finishJSTest();
-};
-
-</script>
-<script src="../../../../js-test-resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/bad-handshake-crash_wsh.py b/tests/tests/webkitsecurity/assets/bad-handshake-crash_wsh.py
deleted file mode 100644
index f3a2feb..0000000
--- a/tests/tests/webkitsecurity/assets/bad-handshake-crash_wsh.py
+++ /dev/null
@@ -1,18 +0,0 @@
-from mod_pywebsocket import handshake
-from mod_pywebsocket.handshake.hybi import compute_accept
-
-
-def web_socket_do_extra_handshake(request):
-    msg = "HTTP/1.1 101 Switching Protocols\r\n"
-    msg += "Upgrade: websocket\r\n"
-    msg += "Connection: Upgrade\r\n"
-    msg += "Sec-WebSocket-Accept: %s\r\n" % compute_accept(request.headers_in["Sec-WebSocket-Key"])[0]
-    msg += "\xa5:\r\n"
-    msg += "\r\n"
-    request.connection.write(msg)
-    print msg
-    raise handshake.AbortedByUserException("Abort the connection") # Prevents pywebsocket from sending its own handshake message.
-
-
-def web_socket_transfer_data(request):
-    pass
diff --git a/tests/tests/webkitsecurity/assets/bad-transition-shorthand-crash.html b/tests/tests/webkitsecurity/assets/bad-transition-shorthand-crash.html
deleted file mode 100644
index 3ac4a66..0000000
--- a/tests/tests/webkitsecurity/assets/bad-transition-shorthand-crash.html
+++ /dev/null
@@ -1,53 +0,0 @@
-<!DOCTYPE html>
-
-<html>
-<head>
-  <style>
-    #box {
-      position: relative;
-      height: 100px;
-      width: 100px;
-      background-color: blue;
-      -webkit-transform: rotate(0);
-      -webkit-transition: -webkit-transform, 2s;
-    }
-  </style>
-  <script>
-    if (window.layoutTestController) {
-      layoutTestController.dumpAsText();
-      layoutTestController.waitUntilDone();
-    }
-    
-    function finish()
-    {
-        if (window.layoutTestController)
-            layoutTestController.notifyDone();
-    }
-    
-    function returnToStart()
-    {
-        var box = document.getElementById('box');
-        box.style.webkitTransform = 'rotate(0)';
-        setTimeout(finish, 20);
-    }
-    
-    function start()
-    {
-        var box = document.getElementById('box');
-        box.style.webkitTransform = 'rotate(180deg)';
-        setTimeout(returnToStart, 20);
-    }
-    
-    window.addEventListener('load', start, false);
-  </script>
-</head>
-<body>
-
-<p>
-This tests a crash that was occuring when you have both an explicit property and 'all' in the -webkit-transition-property
-    CSS property. The crash would occur when you retarget the transition. This test should not crash.
-</p>
-<div id="box">
-</div>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/baseVal-animVal-crash.html b/tests/tests/webkitsecurity/assets/baseVal-animVal-crash.html
deleted file mode 100644
index 1699996..0000000
--- a/tests/tests/webkitsecurity/assets/baseVal-animVal-crash.html
+++ /dev/null
@@ -1,26 +0,0 @@
-<html>
-<head>
-<script src="../../fast/js/resources/js-test-pre.js"></script>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function go() {
-    var oSVGAltGlyphElement = document.createElementNS("http://www.w3.org/2000/svg", "altGlyph");
-    var oSvgMaskElement = document.createElementNS("http://www.w3.org/2000/svg", "mask");
-    var oSvgLengthList = oSVGAltGlyphElement.dy.baseVal;
-    oSvgLengthList.appendItem(oSvgMaskElement.width.animVal);
-    gc();
-    oSvgLengthList.appendItem(oSvgMaskElement.width.animVal);
-    gc();
-    oSvgLengthList.removeItem(0);
-    gc();
-    oSvgLengthList.appendItem(oSvgMaskElement.width.animVal);
-    gc(); 
-}
-</script>
-</head>
-<body onload="go()">
-This test passes if it doesn't crash.
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/baseVal-animVal-list-crash.html b/tests/tests/webkitsecurity/assets/baseVal-animVal-list-crash.html
deleted file mode 100644
index 63519c4..0000000
--- a/tests/tests/webkitsecurity/assets/baseVal-animVal-list-crash.html
+++ /dev/null
@@ -1,19 +0,0 @@
-<html>
-<head>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function go() {
-    var oSvgTextElement = document.createElementNS("http://www.w3.org/2000/svg", "text");
-    var oSvgRectElement = document.createElementNS("http://www.w3.org/2000/svg", "rect");
-    oSvgTextElement.y.animVal;
-    oSvgTextElement.y.baseVal.initialize(oSvgRectElement.x.baseVal);
-    oSvgTextElement.y.animVal.getItem(0);
-}
-</script>
-</head>
-<body onload="go()">
-This test passes if it doesn't crash.
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/before-block-doesnt-crash.html b/tests/tests/webkitsecurity/assets/before-block-doesnt-crash.html
deleted file mode 100644
index db8ab52..0000000
--- a/tests/tests/webkitsecurity/assets/before-block-doesnt-crash.html
+++ /dev/null
@@ -1,23 +0,0 @@
-<meta http-equiv="refresh" content="1;url=" />
-<style>
-    ruby::before {
-        display: block;
-        content: url("http://xx");
-    }
-</style>
-<ruby>
-    <ruby>
-        <ruby>
-            <style>
-                ruby {
-                    float: right;	
-                }
-            </style>
-        </ruby>
-    </ruby>
-</ruby>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-This test passes if it doesn't crash.
diff --git a/tests/tests/webkitsecurity/assets/before-child-non-table-section-add-table-crash.html b/tests/tests/webkitsecurity/assets/before-child-non-table-section-add-table-crash.html
deleted file mode 100644
index a016655..0000000
--- a/tests/tests/webkitsecurity/assets/before-child-non-table-section-add-table-crash.html
+++ /dev/null
@@ -1,25 +0,0 @@
-<html>

-    <body onload="runTest();">

-        <div id="table" style="display: table;">

-            <em id="em"></em>

-            <audio controls="arbitrary" style="display: table-caption;" />

-            <img id="img" />

-        </div>

-        <div id="result"></div>

-        <script type="text/javascript">

-            if (window.layoutTestController)

-                layoutTestController.dumpAsText();

-

-            function runTest()

-            {

-                var img = document.getElementById('img');

-                var em = document.getElementById('em');

-                em.parentNode.replaceChild(img, em);

-                document.body.offsetTop;

-                document.body.removeChild(document.getElementById('table'));

-                

-                document.getElementById("result").innerHTML = "PASS";

-            }

-        </script>

-    </body>

-</html>

diff --git a/tests/tests/webkitsecurity/assets/before-content-with-list-marker-in-anon-block-crash.html b/tests/tests/webkitsecurity/assets/before-content-with-list-marker-in-anon-block-crash.html
deleted file mode 100644
index 09992a1..0000000
--- a/tests/tests/webkitsecurity/assets/before-content-with-list-marker-in-anon-block-crash.html
+++ /dev/null
@@ -1,41 +0,0 @@
-<style>
-.c9::before { float: right; content: counter(section); }
-.c9 { display: list-item; }
-.c19 { display: table-row; }
-.c19:nth-child(even) { position: fixed; }
-</style>
-<script>
-var nodes = Array();
-function runTest() {
-    firstDiv = document.createElement('div');
-    document.documentElement.appendChild(firstDiv);
-
-    secondDiv = document.createElement('div');
-    document.documentElement.appendChild(secondDiv);
-
-    childDivListItem = document.createElement('div');
-    childDivListItem.setAttribute('class', 'c9');
-    document.documentElement.appendChild(childDivListItem);
-
-    citeNode = document.createElement('cite');
-    citeNode.setAttribute('class', 'c19');
-    document.documentElement.appendChild(citeNode);
-
-    parentDivListItem = document.createElement('div');
-    parentDivListItem.setAttribute('class', 'c9');
-    
-    citeNode.appendChild(parentDivListItem);
-
-    document.body.offsetTop;
-    parentDivListItem.appendChild(childDivListItem);
-    document.body.offsetTop;
-    secondDiv.setAttribute('class', 'c1');
-    document.body.offsetTop;
-    firstDiv.setAttribute('class', 'c1');
-
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-}
-window.onload = runTest;
-</script>
-PASS if no assert or crash on debug
diff --git a/tests/tests/webkitsecurity/assets/before-doesnt-crash.html b/tests/tests/webkitsecurity/assets/before-doesnt-crash.html
deleted file mode 100644
index bdbeb2b..0000000
--- a/tests/tests/webkitsecurity/assets/before-doesnt-crash.html
+++ /dev/null
@@ -1,22 +0,0 @@
-<html>
-  <head>
-    <style>
-      :before {
-        content: ""
-      }
-    </style>
-  </head>
-  <body onload="document.linkColor=0;">
-    <ruby>
-      <rt></rt>
-    </ruby>
-    <ruby style="float: left">
-      <rt></rt>
-    </ruby>
-    <script>
-      if (window.layoutTestController)
-          layoutTestController.dumpAsText();
-    </script>
-    This test passes if it doesn't crash.
-  </body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/before-table-doesnt-crash.html b/tests/tests/webkitsecurity/assets/before-table-doesnt-crash.html
deleted file mode 100644
index db8ab52..0000000
--- a/tests/tests/webkitsecurity/assets/before-table-doesnt-crash.html
+++ /dev/null
@@ -1,23 +0,0 @@
-<meta http-equiv="refresh" content="1;url=" />
-<style>
-    ruby::before {
-        display: block;
-        content: url("http://xx");
-    }
-</style>
-<ruby>
-    <ruby>
-        <ruby>
-            <style>
-                ruby {
-                    float: right;	
-                }
-            </style>
-        </ruby>
-    </ruby>
-</ruby>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-This test passes if it doesn't crash.
diff --git a/tests/tests/webkitsecurity/assets/bidi-neutral-in-mixed-direction-run-crash.html b/tests/tests/webkitsecurity/assets/bidi-neutral-in-mixed-direction-run-crash.html
deleted file mode 100755
index 6130b30..0000000
--- a/tests/tests/webkitsecurity/assets/bidi-neutral-in-mixed-direction-run-crash.html
+++ /dev/null
@@ -1,25 +0,0 @@
-<html>

-<style>

-    body { direction: rtl; padding-left: 100%; }

-</style>

-<script>

-    if (window.layoutTestController) {

-        layoutTestController.dumpAsText();

-        layoutTestController.waitUntilDone();

-    }

-

-    function runTest() {

-        document.body.innerHTML = "PASS, if no crash or exceptions thrown";

-

-        if (window.layoutTestController)

-            layoutTestController.notifyDone();

-    }

-

-    setTimeout("runTest()", 0);

-</script>

-0<span>

-<image>

-A 0<div></div>

-</span>

-</html>

-

diff --git a/tests/tests/webkitsecurity/assets/bindings-array-apply-crash.html b/tests/tests/webkitsecurity/assets/bindings-array-apply-crash.html
deleted file mode 100644
index 7ca2c3d..0000000
--- a/tests/tests/webkitsecurity/assets/bindings-array-apply-crash.html
+++ /dev/null
@@ -1,27 +0,0 @@
-<html>
-<body>
-<p>This tests that runtime arrays are not treated as JSArrays when used in Function.apply.  The test passes if it does not crash.</p>
-<pre id="console"></pre>
-<script>
-function log(msg)
-{
-    document.getElementById('console').appendChild(document.createTextNode(msg + "\n"));
-}
-
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-if (!window.objCController)
-    alert("This needs to be run under DRT on the Mac.");
-
-function test()
-{
-    log("PASS: Function called.  No crash!");
-}
-
-var array = window.objCController.testArray();
-test.apply(null, array);
-
-</script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/blob-builder-crash.html b/tests/tests/webkitsecurity/assets/blob-builder-crash.html
deleted file mode 100644
index 62664b1..0000000
--- a/tests/tests/webkitsecurity/assets/blob-builder-crash.html
+++ /dev/null
@@ -1,26 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<script>
-function log(message)
-{
-    document.getElementById('console').appendChild(document.createTextNode(message + "\n"));
-}
-
-function test()
-{
-    log("Test that calling WebKitBlobBuilder.append with null value should not cause crash.");
-    var builder = new WebKitBlobBuilder();
-    builder.append(null);
-
-    log("DONE");
-}
-
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
-</head>
-<body onload="test()">
-<pre id='console'></pre>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/block-not-removed-from-parent-lineboxes-crash.html b/tests/tests/webkitsecurity/assets/block-not-removed-from-parent-lineboxes-crash.html
deleted file mode 100644
index 03bc435..0000000
--- a/tests/tests/webkitsecurity/assets/block-not-removed-from-parent-lineboxes-crash.html
+++ /dev/null
@@ -1,18 +0,0 @@
-<html>
-<body>
-<div style="width: 25px">
-<img style="width: 20px"><img id="test1" style="width: 50px; display: none;"><span id="test2" style="float: left;">AB</span>CD</div>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-    
-document.body.offsetTop;
-test1.style.display = "";
-document.body.offsetTop;
-test2.parentNode.removeChild(test2);
-
-document.body.offsetTop;
-document.body.innerHTML = "PASS: does not crash";
-</script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/block-remove-child-delete-line-box-crash.html b/tests/tests/webkitsecurity/assets/block-remove-child-delete-line-box-crash.html
deleted file mode 100644
index 0832ac4..0000000
--- a/tests/tests/webkitsecurity/assets/block-remove-child-delete-line-box-crash.html
+++ /dev/null
@@ -1,23 +0,0 @@
-<html>

-<style>

-div { -webkit-column-count:2; }

-h1 { -webkit-column-span: all; }

-</style>

-<body>

-<summary>

-<div id="div1">

-BeforeText<span id="span1">SpanText</span>AfterText

-<p>ParaText</p>

-</div>

-<script>

-if (window.layoutTestController)

-    layoutTestController.dumpAsText();

-

-document.body.offsetTop;

-var h1 = document.createElement('h1');

-h1.appendChild(document.createTextNode('heading'));

-div1.insertBefore(h1, span1);

-</script>

-</summary>

-</body>

-</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/block-style-progress-crash.html b/tests/tests/webkitsecurity/assets/block-style-progress-crash.html
deleted file mode 100644
index da0f66e..0000000
--- a/tests/tests/webkitsecurity/assets/block-style-progress-crash.html
+++ /dev/null
@@ -1,19 +0,0 @@
-<!DOCTYPE html>

-<html>

-<head>

-<script>

-

-if (window.layoutTestController)

-    layoutTestController.dumpAsText();

-

-function runTest() {

-    var r = document.createRange();

-    getSelection().addRange(r);

-    document.execCommand('justifyRight', null, true);

-    document.body.innerHTML = 'PASS';

-}

-

-</script>

-</head>

-<body onload="runTest()" contentEditable>

-<progress >>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/blockquote-crash-expected.png b/tests/tests/webkitsecurity/assets/blockquote-crash-expected.png
deleted file mode 100644
index 75bb935..0000000
--- a/tests/tests/webkitsecurity/assets/blockquote-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/blockquote-crash.html b/tests/tests/webkitsecurity/assets/blockquote-crash.html
deleted file mode 100644
index 72c7942..0000000
--- a/tests/tests/webkitsecurity/assets/blockquote-crash.html
+++ /dev/null
@@ -1,33 +0,0 @@
-<html>
-    <head>
-        <style>
-            blockquote {
-                color: blue;
-                border-left: 2px solid blue;
-                padding-left: 5px;
-                margin: 0px;
-            }
-        </style>
-        <script>
-            function test()
-            {
-                if (window.layoutTestController)
-                    layoutTestController.dumpAsText();
-
-                var qt = document.getElementById('qt');
-                var sel = window.getSelection();
-                sel.setPosition(qt, 0);
-                sel.modify("extend", "forward", "line");
-                document.execCommand("InsertNewlineInQuotedContent");
-                
-                document.write("<xmp>" + document.body.innerHTML + "</xmp>");
-            }
-        </script>
-    </head>
-    <body contenteditable onload="test()">
-        <div>This test should not crash</div>
-        <blockquote type="cite" id="qt">triple click me! then hit enter
-            <blockquote type="cite"><div style="min-height: 14px;"></div></blockquote>
-        </blockquote>
-    </body>
-</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/body-clone-link-decl-parent-crash.html b/tests/tests/webkitsecurity/assets/body-clone-link-decl-parent-crash.html
deleted file mode 100644
index 9f5fe3e..0000000
--- a/tests/tests/webkitsecurity/assets/body-clone-link-decl-parent-crash.html
+++ /dev/null
@@ -1,27 +0,0 @@
-<!DOCTYPE html>

-<html>

-<head>

-<script src="../js/resources/js-test-pre.js"></script>

-</head>

-<body>

-Test passes if it does not crash.

-<div id="console"></div>

-<script>

-if (window.layoutTestController)

-    layoutTestController.dumpAsText();

-

-iframe1 = document.createElement('iframe');

-document.body.appendChild(iframe1);

-document1 = iframe1.contentDocument.implementation.createHTMLDocument("document");

-var body1 = document1.body;

-document1.alinkColor = "blue";

-var body2 = body1.cloneNode(true);

-document1.body = document1.createElement('body');

-delete document1;

-gc();

-body2.vLink = 1;

-

-</script>

-<script src="../js/resources/js-test-post.js"></script>

-</body>

-</html>

diff --git a/tests/tests/webkitsecurity/assets/body-removal-crash.html b/tests/tests/webkitsecurity/assets/body-removal-crash.html
deleted file mode 100644
index 0e104f6..0000000
--- a/tests/tests/webkitsecurity/assets/body-removal-crash.html
+++ /dev/null
@@ -1,52 +0,0 @@
-<html>
-<head id="b">
-  <style id="a" type="text/css" media="screen">
-    #box {
-      -webkit-animation-duration: 2s;
-      -webkit-animation-timing-function: linear;
-      -webkit-animation-name: anim;
-      background-color: blue;
-      width: 100px;
-      height: 100px;
-    }
-    @-webkit-keyframes anim {
-        from { -webkit-transform: rotate(0) scale(1,1); }
-        to   { -webkit-transform: rotate(360deg) scale(2,4); }
-    }
-  </style>
-</head>
-<body>
-<div id="box">
-</div>
-<p>This should not crash</p>
-</body>
-</html>
-
-<script>
-
-var element;
-
-function crash() {
-    // trigger style processing
-    document.alinkColor = "aaa";
-    // now remove the body and insert it in a different location
-    element = document.body;
-    element.parentNode.removeChild(element);
-    document.getElementById("a").parentNode.insertBefore(element, document.getElementById("a").nextSibling);
-    setTimeout(cleanup, 0);
-}
-
-function cleanup() {
-  document.getElementById("b").parentNode.insertBefore(element, document.getElementById("b").nextSibling);
-  
-  if (window.layoutTestController)
-      layoutTestController.notifyDone();
-}
-
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-}
-
-crash();
-</script>
diff --git a/tests/tests/webkitsecurity/assets/border-image-crash.html b/tests/tests/webkitsecurity/assets/border-image-crash.html
deleted file mode 100644
index 0bbe36e..0000000
--- a/tests/tests/webkitsecurity/assets/border-image-crash.html
+++ /dev/null
@@ -1,16 +0,0 @@
-<html>
-<head>
-    <title></title>
-    <script>
-        if (window.layoutTestController)
-            layoutTestController.dumpAsText();
-    </script>
-</head>
-<body>
-    <p>
-        Test for crash discovered with -webkit-border-image.  If this text appears, the test passed.
-    </p>
-    <p>
-        <div style="-webkit-border-image: url(resources/greenbox.png) 0 7 0 13 / 0 7 0 13 stretch stretch; width:100; height:100;"></div></p>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/border-image-null-image-crash.html b/tests/tests/webkitsecurity/assets/border-image-null-image-crash.html
deleted file mode 100644
index ce3ed58..0000000
--- a/tests/tests/webkitsecurity/assets/border-image-null-image-crash.html
+++ /dev/null
@@ -1,27 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<meta charset="utf-8">
-<script src="../js/resources/js-test-pre.js"></script>
-</head>
-<body>
-<script>
-
-description("Tests that shorthand border-image with a null image doesn't crash.");
-
-var testContainer = document.createElement("div");
-document.body.appendChild(testContainer);
-
-testContainer.innerHTML = '<div id="test">hello</div>';
-
-e = document.getElementById('test');
-computedStyle = window.getComputedStyle(e, null);
-e.style.borderImage = "10% fill";
-
-shouldBe("computedStyle.getPropertyValue('border-image')", "'none'");
-
-document.body.removeChild(testContainer);
-</script>
-<script src="../js/resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/call-apply-crash.html b/tests/tests/webkitsecurity/assets/call-apply-crash.html
deleted file mode 100644
index 4cf7eba..0000000
--- a/tests/tests/webkitsecurity/assets/call-apply-crash.html
+++ /dev/null
@@ -1,10 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="script-tests/call-apply-crash.js"></script>
-<script src="resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/call-apply-crash.js b/tests/tests/webkitsecurity/assets/call-apply-crash.js
deleted file mode 100644
index e0c8e63..0000000
--- a/tests/tests/webkitsecurity/assets/call-apply-crash.js
+++ /dev/null
@@ -1,10 +0,0 @@
-description("Test to ensure that the registerfile is grown correctly when calling apply");
-
-function testLog() { testPassed(this); }
-(function () {
-    Function.prototype.call.apply(testLog, arguments);
-})('Did not crash using apply', 0, 0); // needs 3+ arguments
-(function () {
-    arguments; // reify the arguments object.
-    Function.prototype.call.apply(testLog, arguments);
-})('Did not crash using apply', 0, 0); // needs 3+ arguments
diff --git a/tests/tests/webkitsecurity/assets/canvas-font-ex-units-crash.html b/tests/tests/webkitsecurity/assets/canvas-font-ex-units-crash.html
deleted file mode 100644
index d39c7cc..0000000
--- a/tests/tests/webkitsecurity/assets/canvas-font-ex-units-crash.html
+++ /dev/null
@@ -1,10 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../js/resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="script-tests/canvas-font-ex-units-crash.js"></script>
-<script src="../js/resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/canvas-font-ex-units-crash.js b/tests/tests/webkitsecurity/assets/canvas-font-ex-units-crash.js
deleted file mode 100644
index 1a3bf8b..0000000
--- a/tests/tests/webkitsecurity/assets/canvas-font-ex-units-crash.js
+++ /dev/null
@@ -1,6 +0,0 @@
-description("Test that setting a font with size in 'ex' units doesn't crash.");
-
-ctx = document.createElement('canvas').getContext('2d');
-
-ctx.font = "5ex sans-serif";
-shouldBe("ctx.font = '5ex sans-serif'; ctx.font", "'5ex sans-serif'");
diff --git a/tests/tests/webkitsecurity/assets/canvas-getImageData-large-crash.html b/tests/tests/webkitsecurity/assets/canvas-getImageData-large-crash.html
deleted file mode 100644
index 6ac1da8..0000000
--- a/tests/tests/webkitsecurity/assets/canvas-getImageData-large-crash.html
+++ /dev/null
@@ -1,14 +0,0 @@
-<html>
-<head>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText(false);
-
-var canvas = document.createElement("canvas");
-canvas.getContext("2d").getImageData(10, 0xffffffff, 2147483647,10);
-</script>
-</head>
-<body>
-PASSED (If this page did not crash.)
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/canvas-toDataURL-crash.html b/tests/tests/webkitsecurity/assets/canvas-toDataURL-crash.html
deleted file mode 100644
index f058dec..0000000
--- a/tests/tests/webkitsecurity/assets/canvas-toDataURL-crash.html
+++ /dev/null
@@ -1,11 +0,0 @@
-<p id="console"></p>
-<p>Calling toDataURL() on a huge canvas shouldn't crash.  If the text above is "PASS", the test passed.</p>
-<canvas id="foo" width="65536" height="65536"></canvas>
-<script>
-var canvas = document.getElementById('foo');
-var url = canvas.toDataURL();
-var p = document.getElementById('console');
-p.innerHTML = "PASS";
-if (window.layoutTestController)
-  layoutTestController.dumpAsText();
-</script>
diff --git a/tests/tests/webkitsecurity/assets/canvas-toDataURL-jpeg-crash.html b/tests/tests/webkitsecurity/assets/canvas-toDataURL-jpeg-crash.html
deleted file mode 100644
index b278d8c..0000000
--- a/tests/tests/webkitsecurity/assets/canvas-toDataURL-jpeg-crash.html
+++ /dev/null
@@ -1,11 +0,0 @@
-Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=69681">bug 69681</a>,
-canvas.toDataURL("image/jpeg") should not crash.<br>
-<p id="log"></p>
-<canvas id="canvas" width="2000" height="2000"></canvas>
-<script>
-var test = document.getElementById('canvas').toDataURL('image/jpeg');
-// Test passes if we don't crash.
-document.getElementById('log').innerHTML = 'PASS';
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
diff --git a/tests/tests/webkitsecurity/assets/cell-in-row-before-misnested-text-crash-css.html b/tests/tests/webkitsecurity/assets/cell-in-row-before-misnested-text-crash-css.html
deleted file mode 100644
index af06554..0000000
--- a/tests/tests/webkitsecurity/assets/cell-in-row-before-misnested-text-crash-css.html
+++ /dev/null
@@ -1,52 +0,0 @@
-<html>
-<head>
-<script type="text/javascript">
-
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function boom()
-{
-  var tr = document.getElementById("tr1");
-  var xxx = document.getElementById("tr1").firstChild;
-
-  tr.insertBefore(document.createTextNode("0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99"), xxx);
-
-  tr.insertBefore(document.createElement("td"), xxx);
-}
-
-</script>
-<style>
-.table {
-    display: table;
-}
-
-.tbody {
-    display: table-row-group;
-}
-
-.tr {
-    display: table-row;
-}
-
-.td {
-    display: table-cell;
-}
-
-</style>
-
-</head>
-
-<body onload="boom()">
-
-<div>This test checks whether a particular odd arrangement of DOM
-nodes results in render tree consistency violations.</div>
-
-<div class="table" border="1">
- <div class="tr" id="tr1"> xxx
-  <div class="td">Whee</div>
- </div>
-</div>
-
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/cell-in-row-before-misnested-text-crash.xhtml b/tests/tests/webkitsecurity/assets/cell-in-row-before-misnested-text-crash.xhtml
deleted file mode 100644
index c722179..0000000
--- a/tests/tests/webkitsecurity/assets/cell-in-row-before-misnested-text-crash.xhtml
+++ /dev/null
@@ -1,35 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-<script type="text/javascript">
-
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function boom()
-{
-  var tr = document.getElementById("tr1");
-  var xxx = document.getElementById("tr1").firstChild;
-
-  tr.insertBefore(document.createTextNode("0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99"), xxx);
-
-  tr.insertBefore(document.createElementNS("http://www.w3.org/1999/xhtml", "td"), xxx);
-}
-
-
-
-</script>
-</head>
-
-<body onload="boom()">
-
-<div>This test checks whether a particular odd arrangement of DOM
-nodes results in render tree consistency violations.</div>
-
-<table border="1">
- <tr id="tr1"> xxx
-  <td>Whee</td>
- </tr>
-</table>
-
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/change-form-element-document-crash.html b/tests/tests/webkitsecurity/assets/change-form-element-document-crash.html
deleted file mode 100644
index 4925401..0000000
--- a/tests/tests/webkitsecurity/assets/change-form-element-document-crash.html
+++ /dev/null
@@ -1,41 +0,0 @@
-<html>
-<head>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function gc() {
-    if (window.GCController)
-        return GCController.collect();
-
-    for (var i = 0; i < 10000; i++)
-        var s = new String("abc");
-}
-
-function crash_test(element_name) {
-    var element = document.createElement(element_name);
-    element.setAttribute('form', '1');
-    var container = document.createElement('div');
-    container.appendChild(element);
-    document.implementation.createDocument().adoptNode(container);
-    container.removeChild(element);
-    delete element;
-    gc();
-    var form = document.createElement('form');
-    form.setAttribute('id', '2');
-    document.body.appendChild(form)
-}
-
-function test() {
-    crash_test('input');
-    crash_test('object');
-    document.body.innerHTML += "PASS";
-}
-</script>
-</head>
-<body onload="test()">
-<p>
-This page is a test case for <a href="https://bugs.webkit.org/show_bug.cgi?id=51418">Bug 51418</a>. WebKit should not crash when this page is loaded.
-</p>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/change-version-no-crash-on-preflight-failure.html b/tests/tests/webkitsecurity/assets/change-version-no-crash-on-preflight-failure.html
deleted file mode 100644
index 2a512fb..0000000
--- a/tests/tests/webkitsecurity/assets/change-version-no-crash-on-preflight-failure.html
+++ /dev/null
@@ -1,36 +0,0 @@
-<html>
-<head>
-<script>
-function finishTest()
-{
-    if (window.layoutTestController)
-        layoutTestController.notifyDone();
-}
-
-function log(message)
-{
-    document.getElementById("console").innerText += message + "\n";
-}
-
-function runTest() {
-    if (window.layoutTestController) {
-        layoutTestController.dumpAsText();
-        layoutTestController.waitUntilDone();
-    }
-
-    var db = window.openDatabase("ChangeVersionFailureTest", "1", "Test the preflight step", 1024);
-    db.changeVersion("2", "3", null, function(error) {
-        log("PASS: db.changeVersion() failed as expected, and no assertions were triggered.");
-        finishTest();
-    }, function() {
-        log("FAIL: db.changeVersion() was expected to fail.");
-        finishTest();
-    });
-}
-</script>
-</head>
-<body onload="runTest();">
-This test verifies that no assertion is triggered when changeVersion()'s preflight step fails.
-<pre id="console"></pre>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/change-widget-and-click-crash.html b/tests/tests/webkitsecurity/assets/change-widget-and-click-crash.html
deleted file mode 100644
index 52ad4af..0000000
--- a/tests/tests/webkitsecurity/assets/change-widget-and-click-crash.html
+++ /dev/null
@@ -1,35 +0,0 @@
-<html>

-<script>

-function clickElement(element) {

-    if (window.eventSender) {

-        var centerX = element.offsetLeft + element.offsetWidth / 2;

-        var centerY = element.offsetTop + element.offsetHeight / 2;

-        eventSender.mouseMoveTo(centerX, centerY);

-        eventSender.mouseDown();

-    }

-}

-

-function crash() {

-    var x = document.getElementById('x');

-    x.setAttribute('data', x.data);

-    clickElement(x);

-    document.body.innerHTML = "PASS";

-

-    if (window.layoutTestController)

-        layoutTestController.notifyDone();

-}

-

-function load() {

-    if (window.layoutTestController) {

-        layoutTestController.dumpAsText();

-        layoutTestController.waitUntilDone();

-    }

-    setTimeout(crash, 0);

-}

-</script>

-<body onload="load()">

-    <object id="x" data="x" border="1" type="application/x-webkit-test-netscape">

-        <param name="wmode" value="transparent">

-    </object>

-</body>

-</html>

diff --git a/tests/tests/webkitsecurity/assets/changing-attrbutes-crash.html b/tests/tests/webkitsecurity/assets/changing-attrbutes-crash.html
deleted file mode 100644
index cd4d578..0000000
--- a/tests/tests/webkitsecurity/assets/changing-attrbutes-crash.html
+++ /dev/null
@@ -1,6 +0,0 @@
-<svg><polygon class="bar" points="foo"></svg>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
-<p>This test passes if it doesn't crash.</p>
diff --git a/tests/tests/webkitsecurity/assets/character-data-mutation-crash-expected.png b/tests/tests/webkitsecurity/assets/character-data-mutation-crash-expected.png
deleted file mode 100644
index 06122f9..0000000
--- a/tests/tests/webkitsecurity/assets/character-data-mutation-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/character-data-mutation-crash.html b/tests/tests/webkitsecurity/assets/character-data-mutation-crash.html
deleted file mode 100644
index 07c4e47..0000000
--- a/tests/tests/webkitsecurity/assets/character-data-mutation-crash.html
+++ /dev/null
@@ -1,21 +0,0 @@
-<!DOCTYPE html>

-<html>

-<body>

-<p>This tests modifying the value of text node that's pointed by the selection and executing an editing command. WebKit should not crash and you should see PASS:</p>

-<div id="test" contenteditable>hello world</div>

-<script>

-

-if (window.layoutTestController)

-    layoutTestController.dumpAsText();

-

-var test = document.getElementById('test');

-test.focus();

-window.getSelection().setBaseAndExtent(test.firstChild, 1, test.firstChild, 10);

-test.firstChild.data = 'hey';

-document.execCommand('insertLineBreak', false, null);

-

-test.innerHTML = 'PASS';

-

-</script>

-</body>

-</html>

diff --git a/tests/tests/webkitsecurity/assets/checkbox-selection-crash.html b/tests/tests/webkitsecurity/assets/checkbox-selection-crash.html
deleted file mode 100644
index 1da71aa..0000000
--- a/tests/tests/webkitsecurity/assets/checkbox-selection-crash.html
+++ /dev/null
@@ -1,28 +0,0 @@
-<head>
-<style>
-.gone { display:none }
-</style>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
-<body>
-Loading this page should not crash.
-<table>
-<td id=td1>
-.<input id=cb type="checkbox">.
-</table>
-<script>
-    var sel = window.getSelection();
-    var td1 = document.getElementById('td1')
-    // having selection triggers Document::updateRendering() from paint()
-    sel.setBaseAndExtent(td1, 0, td1, 1000);
-    // this causes style recalc and rendering tree tear down (from updateRendering) in middle of painting, which crashes
-    document.body.setAttribute('class','gone');
-    var cb = document.getElementById('cb')
-    // this triggers synchronous paint() 
-    cb.click();  
-    document.body.setAttribute('class','');  
-</script>
-</body>
-
diff --git a/tests/tests/webkitsecurity/assets/child-not-removed-from-parent-lineboxes-crash.html b/tests/tests/webkitsecurity/assets/child-not-removed-from-parent-lineboxes-crash.html
deleted file mode 100644
index ef81794..0000000
--- a/tests/tests/webkitsecurity/assets/child-not-removed-from-parent-lineboxes-crash.html
+++ /dev/null
@@ -1,28 +0,0 @@
-<html>
-<body>
-</body>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-var tags = ['a', 'abbr', 'acronym', 'address', 'applet', 'area', 'article', 'aside', 'audio', 'b', 'base', 'basefont', 'bdo', 'bgsound', 'big', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'command', 'datagrid', 'datalist', 'dcell', 'dcol', 'drow', 'dd', 'del', 'details', 'dfn', 'dir', 'div', 'dl', 'dt', 'em', 'embed', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'frame', 'frameset', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'child', 'image', 'img', 'input', 'ins', 'isindex', 'kbd', 'keygen', 'label', 'layer', 'legend', 'li', 'link', 'listing', 'map', 'mark', 'marquee', 'menu', 'meta', 'meter', 'nav', 'nobr', 'noembed', 'noframes', 'nolayer', 'object', 'ol', 'optgroup', 'option', 'output', 'p', 'param', 'plaintext', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'script', 'section', 'select', 'small', 'source', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'textarea', 'tfoot', 'th', 'thead', 'title', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr', 'xmp', 'noscript', 'noscript', 'math', 'mfrac', 'mfenced', 'msubsup', 'mrow', 'mover', 'munder', 'munderover', 'msqrt', 'mroot', 'mi', 'mn', 'mo', 'mtext', 'msub', 'msup', 'ms', 'mglyph', 'malignmark', 'annotation-xml', 'a', 'access', 'anchor', 'br', 'card', 'do', 'fieldset', 'go', 'head', 'img', 'input', 'insertedLegend', 'meta', 'noop', 'onevent', 'optgroup', 'option', 'p', 'postfield', 'prev', 'refresh', 'select', 'setvar', 'table', 'td', 'template', 'timer', 'tr', 'a', 'altGlyph', 'altGlyphDef', 'altGlyphItem', 'animate', 'animateColor', 'animateMotion', 'animateTransform', 'set', 'circle', 'clipPath', 'color_profile', 'cursor', 'defs', 'desc', 'ellipse', 'feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence', 'filter', 'font', 'font_face', 'font_face_format', 'font_face_name', 'font_face_src', 'font_face_uri', 'foreignObject', 'g', 'glyph', 'glyphRef', 'hkern', 'image', 'line', 'linearGradient', 'marker', 'mask', 'metadata', 'missing_glyph', 'mpath', 'path', 'pattern', 'polygon', 'polyline', 'radialGradient', 'rect', 'script', 'stop', 'style', 'svg', 'switch', 'symbol', 'text', 'textPath', 'title', 'tref', 'tspan', 'use', 'view', 'vkern']
-
-for (i = 0; i < tags.length; i++)
-{
-    child = document.createElement(tags[i]);
-    child.style.position = 'absolute';
-    document.body.appendChild(document.createTextNode('aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaad'));
-    document.body.appendChild(child);
-    document.body.appendChild(document.createTextNode('aaaa'));
-    document.body.offsetTop;
-    child.setAttribute('style', '');
-    document.body.offsetTop;
-    document.body.removeChild(child);
-    document.body.offsetTop;
-    document.body.innerHTML = "";
-}
-
-document.body.innerHTML = "PASS: does not crash";
-</script>
-</html>
-
diff --git a/tests/tests/webkitsecurity/assets/chromium-linux-fallback-crash.html b/tests/tests/webkitsecurity/assets/chromium-linux-fallback-crash.html
deleted file mode 100644
index 487bf0a..0000000
--- a/tests/tests/webkitsecurity/assets/chromium-linux-fallback-crash.html
+++ /dev/null
@@ -1,12 +0,0 @@
-<html>
-  <script>
-    if (window.layoutTestController)
-      layoutTestController.dumpAsText();
-  </script>
-
-  <body>
-    <p>Previously this would crash Chromium Linux by triggering a NULL pointer dereference in the font fallback code.</p>
-
-    <span style="font-family: -webkit-family-will-not-be-found;">Foo</span>
-  </body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/clear-floats-crash.svg b/tests/tests/webkitsecurity/assets/clear-floats-crash.svg
deleted file mode 100644
index eef7ac7..0000000
--- a/tests/tests/webkitsecurity/assets/clear-floats-crash.svg
+++ /dev/null
@@ -1,25 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">

-  <body>

-    This test is to ensure that we do not crash when clearing floats during SVG load.

-    <div id="log"><span style='color: red;'>FAIL:</span> Did not complete test</div>

-    <svg xmlns="http://www.w3.org/2000/svg">

-      <g>

-        <text style="float:right"></text>

-        <text></text>

-      </g>

-    </svg>

-    <script>

-        if (window.layoutTestController)

-            layoutTestController.dumpAsText();

-        var log = document.getElementById("log");

-        while (log.childNodes.length)

-            log.removeChild(log.firstChild);

-        var msg = document.createElementNS("http://www.w3.org/1999/xhtml", "span");

-        msg.style.color = "green";

-        msg.appendChild(document.createTextNode("PASS:"));

-        log.appendChild(msg);

-        log.appendChild(document.createTextNode(" Did not crash while rendering the SVG."));

-    </script>

-  </body>

-</html>

-

diff --git a/tests/tests/webkitsecurity/assets/clear-watch-invalid-id-crash.html b/tests/tests/webkitsecurity/assets/clear-watch-invalid-id-crash.html
deleted file mode 100644
index f7f45cc..0000000
--- a/tests/tests/webkitsecurity/assets/clear-watch-invalid-id-crash.html
+++ /dev/null
@@ -1,10 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../js/resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="script-tests/clear-watch-invalid-id-crash.js"></script>
-<script src="../../js/resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/clear-watch-invalid-id-crash.js b/tests/tests/webkitsecurity/assets/clear-watch-invalid-id-crash.js
deleted file mode 100644
index 040f003..0000000
--- a/tests/tests/webkitsecurity/assets/clear-watch-invalid-id-crash.js
+++ /dev/null
@@ -1,15 +0,0 @@
-description("Tests for a crash when clearWatch() is called with a zero ID.<br><br>We call clearWatch() with a request in progress then navigate the page. This accesses the watchers map during cleanup and triggers the crash. This page should not be visible when the test completes.");
-
-if (window.layoutTestController) {
-    layoutTestController.setGeolocationPermission(true);
-    layoutTestController.setMockGeolocationPosition(51.478, -0.166, 100);
-} else
-    debug('This test can not be run without the LayoutTestController');
-
-document.body.onload = function() {
-    navigator.geolocation.watchPosition(function() {});
-    navigator.geolocation.clearWatch(0);
-    location = "data:text/html,TEST COMPLETE<script>if(window.layoutTestController) layoutTestController.notifyDone();</script>";
-}
-
-window.jsTestIsAsync = true;
diff --git a/tests/tests/webkitsecurity/assets/click-internal-anchor-with-use-crash.xhtml b/tests/tests/webkitsecurity/assets/click-internal-anchor-with-use-crash.xhtml
deleted file mode 100644
index 8c5b4dc..0000000
--- a/tests/tests/webkitsecurity/assets/click-internal-anchor-with-use-crash.xhtml
+++ /dev/null
@@ -1,27 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<html>
-    <svg xmlns="http://www.w3.org/2000/svg" onload="onLoad()" xmlns:xlink="http://www.w3.org/1999/xlink">
-        <script type="text/javascript">
-        function onLoad()
-        {
-            clickLink(document.getElementById("link"));
-            
-            if (window.layoutTestController)
-                layoutTestController.dumpAsText();
-        }
-
-        function clickLink(link)
-        {
-            var event = document.createEvent("MouseEvents");
-            event.initMouseEvent("click", true, true, window,
-                0, 0, 0, 0, 0,
-                false, false, false, false,
-                0, null);
-            link.dispatchEvent(event);
-        }
-        </script>
-        <a id="link" xlink:href="#">
-            <text x="50" y="50">PASS if no crash</text>
-        </a>
-    </svg>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/click-size-zero-no-crash.html b/tests/tests/webkitsecurity/assets/click-size-zero-no-crash.html
deleted file mode 100644
index df44e72..0000000
--- a/tests/tests/webkitsecurity/assets/click-size-zero-no-crash.html
+++ /dev/null
@@ -1,33 +0,0 @@
-<html>
-<script src="../js/resources/js-test-pre.js"></script>
-<script>
-function getCenterFor(element)
-{
-  var rect = element.getBoundingClientRect();
-  return { x : parseInt((rect.left + rect.right) / 2) , y : parseInt((rect.top + rect.bottom) / 2)};
-}
-
-function runTest()
-{
-  if (!window.layoutTestController)
-    return;
-  if (!window.eventSender)
-    return;
-
-  layoutTestController.dumpAsText();
-  center = getCenterFor(document.getElementById("emptyselect"));
-  eventSender.mouseMoveTo(center.x, center.y);
-  eventSender.mouseDown();
-  eventSender.mouseUp();
-  eventSender.keyDown("downArrow");
-}
-
-</script>
-<style>
-</style>
-<body onload="runTest();">
-<select multiple id="emptyselect"></select>
-This should not crash
-</body>
-</html>
-
diff --git a/tests/tests/webkitsecurity/assets/clone-anonymous-block-non-inline-child-crash-expected.png b/tests/tests/webkitsecurity/assets/clone-anonymous-block-non-inline-child-crash-expected.png
deleted file mode 100644
index 9f813ab..0000000
--- a/tests/tests/webkitsecurity/assets/clone-anonymous-block-non-inline-child-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/clone-anonymous-block-non-inline-child-crash.html b/tests/tests/webkitsecurity/assets/clone-anonymous-block-non-inline-child-crash.html
deleted file mode 100644
index 3ef1ef4..0000000
--- a/tests/tests/webkitsecurity/assets/clone-anonymous-block-non-inline-child-crash.html
+++ /dev/null
@@ -1,21 +0,0 @@
-<html>

-<style>

-div { 

-    border: 5px solid maroon; 

-    -webkit-column-count: 2;

-    margin: 1em 0;

-}

-h2 { 

-    -webkit-column-span: all;

-    background-color: #eeeeee;

-    color: black;

-}

-</style>

-<div>

-<label>Some inline text

-<summary>Some block text

-<h2>PASS</h2>

-Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Nulla varius enim ac mi. Curabitur sollicitudin felis quis lectus. Quisque adipiscing rhoncus sem. Proin nulla purus, vulputate vel, varius ut, euismod et, nisi. Sed vitae felis vel orci sagittis aliquam. Cras convallis adipiscing sem. Nam nonummy enim. Nullam bibendum lobortis neque. Vestibulum velit orci, tempus euismod, pretium quis, interdum vitae, nulla. Phasellus eget ante et tortor condimentum vestibulum.

-Suspendisse hendrerit quam nec felis. Sed varius turpis vitae pede. Lorem ipsum dolor sit amet, consectetuer adipiscing elit.

-</div>

-</html>

diff --git a/tests/tests/webkitsecurity/assets/clone-before-after-content-crash.html b/tests/tests/webkitsecurity/assets/clone-before-after-content-crash.html
deleted file mode 100755
index c0116d4..0000000
--- a/tests/tests/webkitsecurity/assets/clone-before-after-content-crash.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<html>
-  <head>
-    <style>
-      #test1 { -webkit-column-count: 1; }
-      #test2 { display: block; }
-      #test3::after { display: block; content: "A"; }
-      #test4 { -webkit-column-span: all; }
-    </style>
-    <script>
-	  if (window.layoutTestController)
-	      layoutTestController.dumpAsText();
-      function runTest(){
-        test1 = document.createElement('div');
-        test1.setAttribute('id', 'test1');
-        document.body.appendChild(test1);
-        test2 = document.createElement('div');
-        test2.setAttribute('id', 'test2');
-        test1.appendChild(test2);
-        test3 = document.createElement('div');
-        test3.setAttribute('id', 'test3');
-        test2.appendChild(test3);
-        test4 = document.createElement('span');
-        test4.setAttribute('id', 'test4');
-        test3.appendChild(test4);
-        document.body.offsetTop;
-        test4.style.display='block';
-      }
-      window.onload = runTest
-    </script>
-  </head>
-  <body>
-  Test passes if it does not crash.
-  </body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/clone-block-children-inline-mismatch-crash.html b/tests/tests/webkitsecurity/assets/clone-block-children-inline-mismatch-crash.html
deleted file mode 100644
index 534b7ae..0000000
--- a/tests/tests/webkitsecurity/assets/clone-block-children-inline-mismatch-crash.html
+++ /dev/null
@@ -1,29 +0,0 @@
-<!DOCTYPE html>
-<html>
-Test passes if it does not crash.
-<style>
-#div1 { -webkit-column-count: 2; }
-#q1 { display: block; }
-#q1::before { display: table-row; }
-#div2 { -webkit-column-span: all; }
-</style>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function runTest() 
-{
-    div1 = document.createElement('div');
-    div1.setAttribute('id', 'div1'); 
-    document.body.appendChild(div1); 
-    q1 = document.createElement('q'); 
-    q1.setAttribute('id', 'q1');
-    div1.appendChild(q1);
-    div2 = document.createElement('div');
-    div2.setAttribute('id', 'div2'); 
-    q1.appendChild(div2); 
-}
-
-window.onload = runTest;
-</script>
-</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/cloneNode-after-deleteRule-crash.html b/tests/tests/webkitsecurity/assets/cloneNode-after-deleteRule-crash.html
deleted file mode 100644
index 689310e..0000000
--- a/tests/tests/webkitsecurity/assets/cloneNode-after-deleteRule-crash.html
+++ /dev/null
@@ -1,22 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<meta charset="utf-8">
-<script src="../js/resources/js-test-pre.js"></script>
-</head>
-<body>
-<script>
-
-function runtest() {
-    q = document.getElementsByTagName('object')[0].contentDocument;
-    q.styleSheets[0].deleteRule(1);
-    q.getElementsByTagName('head')[0].cloneNode(true);
-}
-
-description("This test checks that mutating a stylesheet and then using cloneNode() in a subdocument doesn't cause a crash.");
-
-</script>
-<object data="resources/cloneNode-after-deleteRule-subdocument.html" onload="runtest()"/>
-<script src="../js/resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/close-in-onmessage-crash.html b/tests/tests/webkitsecurity/assets/close-in-onmessage-crash.html
deleted file mode 100644
index 2805949..0000000
--- a/tests/tests/webkitsecurity/assets/close-in-onmessage-crash.html
+++ /dev/null
@@ -1,36 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head></head>
-<body>
-<p>Nested creation of two WebSockets should not cause a crash.</p>
-<p></p>
-<p>On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".</p>
-<pre id=log>
-</pre>
-<script>
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-    layoutTestController.overridePreference("WebKitHixie76WebSocketProtocolEnabled", 0);
-}
-
-function log(message)
-{
-    document.getElementById("log").innerHTML += message + "\n";
-}
-
-function endTest()
-{
-    log("TEST COMPLETE");
-    if (window.layoutTestController)
-        layoutTestController.notifyDone();
-}
-var worker = new Worker('resources/close-in-onmessage-crash.js');
-worker.onmessage = function (evt) {
-    log(evt.data);
-    if (evt.data == "DONE")
-        endTest();
-};
-</script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/close-in-onmessage-crash.js b/tests/tests/webkitsecurity/assets/close-in-onmessage-crash.js
deleted file mode 100644
index 9abcc9e..0000000
--- a/tests/tests/webkitsecurity/assets/close-in-onmessage-crash.js
+++ /dev/null
@@ -1,30 +0,0 @@
-function runTests()
-{
-    try {
-        var url = 'ws://localhost:8880/websocket/tests/hybi/workers/resources/simple';
-        var ws = new WebSocket(url);
-
-        ws.onopen = function()
-        {
-            postMessage('PASS: worker: Connected.');
-        };
-
-        ws.onmessage = function(messageEvent)
-        {
-            postMessage('PASS: worker: Received message: "' + messageEvent.data + '"');
-            ws.close();
-        };
-
-        ws.onclose = function()
-        {
-            postMessage('PASS: worker: Closed.');
-            postMessage('DONE');
-        };
-    } catch (e) {
-        postMessage('FAIL: worker: Unexpected exception: ' + e);
-    } finally {
-        postMessage('PASS: worker: Parsed successfully.');
-    }
-}
-
-runTests();
diff --git a/tests/tests/webkitsecurity/assets/column-span-parent-continuation-crash.html b/tests/tests/webkitsecurity/assets/column-span-parent-continuation-crash.html
deleted file mode 100644
index 2a110f3..0000000
--- a/tests/tests/webkitsecurity/assets/column-span-parent-continuation-crash.html
+++ /dev/null
@@ -1,36 +0,0 @@
-<!DOCTYPE html>

-<html>

-<body>

-<div id="console"></div>

-<style>

-div { -webkit-column-count: 1; }

-h2 { -webkit-column-span: all; }

-</style>

-<script src="../js/resources/js-test-pre.js"></script>

-<script>

-if (window.layoutTestController) {

-    layoutTestController.dumpAsText();

-    layoutTestController.waitUntilDone();

-}

-

-function runTest()

-{

-    document.body.offsetTop;

-    child = document.getElementById('test');

-    child.parentNode.removeChild(child);

-    child = document.getElementById('anything');

-    gc();

-    document.body.innerHTML = "PASS";

-

-    if (window.layoutTestController)

-        layoutTestController.notifyDone();

-}

-

-setTimeout("runTest()", 0);

-</script>

-<script src="../js/resources/js-test-post.js"></script>

-<div>

-<span id="test"><h2></span>

-</div>

-</body>

-</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/combining-character-sequence-fallback-crash.html b/tests/tests/webkitsecurity/assets/combining-character-sequence-fallback-crash.html
deleted file mode 100644
index 1b4145b..0000000
--- a/tests/tests/webkitsecurity/assets/combining-character-sequence-fallback-crash.html
+++ /dev/null
@@ -1,14 +0,0 @@
-<p>
-    Test for <i><a href="https://bugs.webkit.org/show_bug.cgi?id=68737">https://bugs.webkit.org/show_bug.cgi?id=68737</a>
-    REGRESSION (r95391): Crash in -[WebCascadeList objectAtIndex:] when a font-family list contains missing fonts</i>.
-</p>
-<p>
-    The test passes if it does not cause a crash.
-</p>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-<div style="font-family: verdana, a-font-you-do-not-have;">
-    i&#x0302; and i&#x033f;
-</div>
diff --git a/tests/tests/webkitsecurity/assets/console-long-eval-crash.html b/tests/tests/webkitsecurity/assets/console-long-eval-crash.html
deleted file mode 100644
index 75444bb..0000000
--- a/tests/tests/webkitsecurity/assets/console-long-eval-crash.html
+++ /dev/null
@@ -1,31 +0,0 @@
-<html>
-<head>
-<script src="../../http/tests/inspector/inspector-test.js"></script>
-<script src="../../http/tests/inspector/console-test.js"></script>
-<script>
-
-layoutTestController.setCanOpenWindows();
-
-function doDialog()
-{
-    layoutTestController.closeWebInspector();
-    showModalDialog('data:text/html,<script>setTimeout(close, 0);%3c/script>');
-    setTimeout(function(){layoutTestController.notifyDone();}, 0);
-}
-
-function test()
-{
-    RuntimeAgent.evaluate("doDialog()");
-}
-
-</script>
-</head>
-
-<body onload="runTest()">
-<p>
-Test that any long api call from the frontend will not crash the inspected page's renderer if the page is reloaded or frontend is closed in the middle.
-</p>
-<a href="https://bugs.webkit.org/show_bug.cgi?id=60616">https://bugs.webkit.org/show_bug.cgi?id=60616</a>
-
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/constructor-as-function-crash.html b/tests/tests/webkitsecurity/assets/constructor-as-function-crash.html
deleted file mode 100644
index 29e20d3..0000000
--- a/tests/tests/webkitsecurity/assets/constructor-as-function-crash.html
+++ /dev/null
@@ -1,32 +0,0 @@
-<html>
-<head>
-    <title>Calling bindings constructors as function should not cause a crash</title>
-    <script>
-        if (window.layoutTestController)
-            layoutTestController.dumpAsText();
-
-        function runTest()
-        {
-            // List of constructors to test.
-            var constructors = ["EventSource", "MessageChannel", "SharedWorker", "WebGLArrayBuffer", "WebKitCSSMatrix", "WebKitPoint", "WebSocket", "Worker", "XMLHttpRequest", "XSLTProcessor"];
-            var result = document.getElementById("result");
-            for (var i in constructors) {
-                try {
-                    var func = constructors[i] + "()";
-                    eval(func);
-                    result.innerHTML += "FAIL";
-                }
-                catch (e) {
-                    result.innerHTML += "PASS";
-                }
-                result.innerHTML += ": " + constructors[i] + "<br/>";
-            }
-        }
-
-    </script>
-</head>
-<body onload="runTest()">
-    <p>Calling <code>bindings</code> constructors as function should throw an exception and not cause a crash.</p>
-    <div id="result"></div>
-</html>
-
diff --git a/tests/tests/webkitsecurity/assets/container-transform-crash.html b/tests/tests/webkitsecurity/assets/container-transform-crash.html
deleted file mode 100644
index e6b1ff3..0000000
--- a/tests/tests/webkitsecurity/assets/container-transform-crash.html
+++ /dev/null
@@ -1,29 +0,0 @@
-<html>
-  <head>
-    <script>
-      if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-    </script>
-    <style>
-      .container {
-        position: relative;
-        height: 350px;
-        width: 400px;
-        border: 1px solid black;
-        margin: 10px;
-      }
-      
-      .container > a {
-        -webkit-transform: rotate(20deg);
-      }
-    </style>
-  </head>
-<body>
-    Inline with -webkit-transform that contains positioned element. This should not crash.
-    <div class="container">
-        <a href="#">
-            <div style="height: 150px; top: 100px; width: 160px; background-color: grey; position: absolute; left: 134px;"><p>some text here</p></div>
-        </a>
-    </div>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/content-height-zero-crash.html b/tests/tests/webkitsecurity/assets/content-height-zero-crash.html
deleted file mode 100644
index 071e003..0000000
--- a/tests/tests/webkitsecurity/assets/content-height-zero-crash.html
+++ /dev/null
@@ -1,10 +0,0 @@
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-<p>
-    This tests for a crash when specifying multiple columns for a block with 0 content height.
-</p>
-<div style="height: 0; -webkit-column-count: 2;">
-    <div style="height: 50px; width: 100px;"></div>
-</div>
diff --git a/tests/tests/webkitsecurity/assets/context-destroyed-crash.html b/tests/tests/webkitsecurity/assets/context-destroyed-crash.html
deleted file mode 100644
index 7a616e7..0000000
--- a/tests/tests/webkitsecurity/assets/context-destroyed-crash.html
+++ /dev/null
@@ -1,44 +0,0 @@
-<html>
-<head>
-<script src="resources/webgl-test.js"></script>
-</head>
-<body>
-<script>
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-}
-
-function gc()
-{
-    if (window.GCController)
-        return GCController.collect();
-
-    for (var i = 0; i < 10000; ++i)
-        var s = new String("AAAA");
-}
-
-window.onload = function()
-{
-    canvas = document.createElement("canvas");
-    context = create3DContext(canvas);
-    extension = context.getExtension("WEBKIT_WEBGL_lose_context");
-    
-    canvas = null;
-    context = null;
-    gc();
-    
-    setTimeout(finishTest, 1);
-}
-
-function finishTest()
-{
-    extension.loseContext();
-    
-    document.body.innerHTML = "PASS";
-    if (window.layoutTestController)
-        layoutTestController.notifyDone();
-}
-</script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/continuationCrash-expected.png b/tests/tests/webkitsecurity/assets/continuationCrash-expected.png
deleted file mode 100644
index 6c37873..0000000
--- a/tests/tests/webkitsecurity/assets/continuationCrash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/continuationCrash.html b/tests/tests/webkitsecurity/assets/continuationCrash.html
deleted file mode 100644
index 3c2cd12..0000000
--- a/tests/tests/webkitsecurity/assets/continuationCrash.html
+++ /dev/null
@@ -1,57 +0,0 @@
-<html>
-<head>
-
-<script language="JavaScript">
-function setBlock() {
-	var el = document.getElementById("block");
-	el.style.display="block";
-}
-function setOutline() {
-	var el = document.getElementById("outline");
-	el.style.outline="2px solid red";
-}
-function setSpan() {
-	var newChild = document.createElement("span");
-	newChild.setAttribute("id", "outline");
-	var aSpan = document.createElement("span");
-	aSpan.setAttribute("id", "block");
-	newChild.appendChild(aSpan);
-	var oldChild = document.body.firstChild;
-	document.body.replaceChild(newChild, oldChild);
-}
-</script>
-
-</head>
-
-<body><span id="outline">
-	<span id="block">A span-element</span>
-</span>
-
-<h4>Instructions</h4>
-<p>Click the following buttons.</p>
-<ol>
-<li>Start with the outmost left one.</id>
-<li>Click the middle one.</li>
-<li>(The ouline will not be updated correctly.)
-<li>Click the right button.</li>
-<li>This will crash Safari 1.3 (v176 and v170, no other configurations tested).</li>
-<li>The combination 2. 1. 3. will also crash Safari.</li>
-<li>1. 3. will not crash Safari. (But the outline should vanish. Shouldn't it?)</li>
-<li>2. 3. will not crash Safari either.</li>
-
-<script>
-    setOutline();
-</script>
-<script>
-    setBlock();
-</script>
-<script>
-    setSpan();
-</script>
-
-<input type="button" value="1. Set outline property" onclick="setOutline()" />
-<input type="button" value="2. Set display property" onclick="setBlock()" />
-<input type="button" value="3. Replace span-element" onclick="setSpan()" />
-</body>
-
-</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/convolution-crash-expected.png b/tests/tests/webkitsecurity/assets/convolution-crash-expected.png
deleted file mode 100644
index 05dc2eb..0000000
--- a/tests/tests/webkitsecurity/assets/convolution-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/convolution-crash.svg b/tests/tests/webkitsecurity/assets/convolution-crash.svg
deleted file mode 100644
index c11ca6e..0000000
--- a/tests/tests/webkitsecurity/assets/convolution-crash.svg
+++ /dev/null
@@ -1,5 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
-<defs> <filter id="foo"> <feConvolveMatrix kernelMatrix="0 0 0 0 1 0 0 0 -1"/> </filter> </defs>
-<image width="2" height="3" xlink:href="bar" filter="url(#foo)" />
-<rect x="10" y="10" width="100" height="100" fill="green"/>
-</svg>
diff --git a/tests/tests/webkitsecurity/assets/copy-crash-with-extraneous-attribute.html b/tests/tests/webkitsecurity/assets/copy-crash-with-extraneous-attribute.html
deleted file mode 100644
index 99777bd..0000000
--- a/tests/tests/webkitsecurity/assets/copy-crash-with-extraneous-attribute.html
+++ /dev/null
@@ -1,18 +0,0 @@
-<html>
-<head>
-    <script src=../editing.js language="JavaScript" type="text/JavaScript" ></script>
-    <script>
-        if (window.layoutTestController)
-            layoutTestController.dumpAsText();
-    </script>
-</head>
-
-<body background>
-This test passes if it does not crash.
-
-<script>
-    selectAllCommand();
-    copyCommand();
-</script>
-
-</html>
diff --git a/tests/tests/webkitsecurity/assets/copy-crash.html b/tests/tests/webkitsecurity/assets/copy-crash.html
deleted file mode 100644
index 4dce284..0000000
--- a/tests/tests/webkitsecurity/assets/copy-crash.html
+++ /dev/null
@@ -1,358 +0,0 @@
-<html>
-  <head>
-    <script src="../editing.js" language="JavaScript" type="text/JavaScript" ></script>
-    <style type="text/css">
-      div.popup {
-        color: black !important;
-        background: yellow !important;
-        padding: 0.5em !important;
-        position: absolute !important;
-        z-index: 20000 !important;
-        display: none;
-      }
-    </style>
-    <script type="text/javascript">
-      function getAbsolutePosition(element) {
-        var r = { x: element.offsetLeft, y: element.offsetTop };
-        if (element.offsetParent) {
-          var tmp = getAbsolutePosition(element.offsetParent);
-          r.x += tmp.x;
-          r.y += tmp.y;
-        }
-        return r;
-      }
-
-      function runTest1() {
-        if (!window.layoutTestController)
-          return;
-        layoutTestController.waitUntilDone();
-        layoutTestController.dumpAsText();
-
-        e = document.getElementById("mouse_target");
-        r = getAbsolutePosition(e);
-        x = r.x + e.offsetLeft + e.offsetWidth / 2;
-        y = r.y + e.offsetTop + e.offsetHeight / 2;
-        eventSender.mouseMoveTo(x, y);
-        window.setTimeout("runTest2()", 400);
-      }
-
-      function runTest2() {
-        e = document.getElementById("select_target");
-        r = getAbsolutePosition(e);
-
-        setSelectionCommand(e, 0, e, 1);
-        eventSender.mouseMoveTo(0, 0);
-        window.setTimeout("runTest3()", 200);
-      }
-
-      function runTest3() {
-        copyCommand();
-        layoutTestController.notifyDone();
-      }
-
-      function MPP_bind(fn, self, var_args) {
-        var boundargs = fn.boundArgs_ || [];
-        boundargs = boundargs.concat(Array.prototype.slice.call(arguments, 2));
-
-        if (typeof fn.boundSelf_ != 'undefined') {
-          self = fn.boundSelf_;
-        }
-
-        if (typeof fn.foundFn_ != 'undefined') {
-          fn = fn.boundFn_;
-        }
-
-        var newfn = function() {
-          var args = boundargs.concat(Array.prototype.slice.call(arguments));
-          return fn.apply(self, args);
-        }
-
-        newfn.boundArgs_ = boundargs;
-        newfn.boundSelf_ = self;
-        newfn.boundFn_ = fn;
-
-        return newfn;
-      };
-
-      function PersonPopup() {
-        this.pointerPosX = 0;
-        this.pointerPosY = 0;
-
-        this.pointerOnTargetElement = false;
-
-        this.targetPosX = 0;
-        this.targetPosY = 0;
-        this.targetWidth = 0;
-        this.targetHeight = 0;
-        this.targetElement = 0;
-
-        this.delayed = false;
-        this.visible = false;
-        this.pointerOutsidePopup = false;
-
-        this.showTimerID = -1;
-        this.hideTimerID = -1;
-
-        window.addEventListener('load',
-                                MPP_bind(this.handleOnLoad_, this), null);
-
-      };
-
-      PersonPopup.prototype.getPointerX_ = function(e) {
-        var x, scrollLeft;
-
-        if (e.pageX) {
-          x = e.pageX;
-        } else if (e.clientX) {
-          x = e.clientX + document.body.scrollLeft;
-        } else {
-          x = 0;
-        }
-        return x;
-      };
-
-      PersonPopup.prototype.getPointerY_ = function(e) {
-        var y, scrollTop;
-
-        if (e.pageY) {
-          y = e.pageY;
-        } else if (e.clientY) {
-          y = e.clientY + document.body.scrollTop;
-        } else {
-          y = 0;
-        }
-        return y;
-      };
-
-      PersonPopup.prototype.pointerCloseEnough_ = function(x, y) {
-        var POINTER_TOLERANCE = 5;
-        if (this.pointerOutsidePopup) {
-          if ((x >= this.targetPosX) &&
-              (x <= this.targetPosX + this.targetWidth) &&
-              (y >= this.targetPosY) &&
-              (y <= this.targetPosY + this.targetHeight)) {
-            this.pointerOutsidePopup = false;
-            return true;
-          }
-        } else {
-          if ((x >= this.targetPosX - POINTER_TOLERANCE) &&
-              (x <= this.targetPosX + this.targetWidth +
-                    POINTER_TOLERANCE) &&
-              (y >= this.targetPosY - POINTER_TOLERANCE) &&
-              (y <= this.targetPosY + this.targetHeight +
-                    POINTER_TOLERANCE)) {
-            this.pointerOutsidePopup = false;
-            return true;
-          }
-        }
-
-        return false;
-      };
-
-      PersonPopup.prototype.handleMouseMove_ = function(e) {
-        if ((this.delayed) || (this.visible)) {
-          e = e || window.event;
-
-          var x = this.getPointerX_(e);
-          var y = this.getPointerY_(e);
-
-          if (this.pointerCloseEnough_(x, y)) {
-            if (this.hideTimerID) {
-              window.clearTimeout(this.hideTimerID);
-              this.hideTimerID = -1;
-            }
-          } else {
-            if (this.hideTimerID == -1) {
-              this.hideTimerID = window.setTimeout(MPP_bind(this.hide_, this),
-                                                   200);
-            }
-          }
-        }
-      };
-
-      PersonPopup.prototype.resizeElement_ = function(el, x, y, w, h) {
-        if (x != false) {
-          el.style.left = x + 'px';
-        }
-        if (y != false) {
-          el.style.top = y + 'px';
-        }
-        if (w != false) {
-          el.style.width = w + 'px';
-        }
-        if (h != false) {
-          el.style.height = h + 'px';
-        }
-      };
-
-      PersonPopup.prototype.show_ = function() {
-        this.showTimerID = -1;
-
-        if (this.hideTimerID != -1) {
-          this.delayed = false;
-          return;
-        }
-        if (!this.pointerOnTargetElement) {
-          this.delayed = false;
-          return;
-        }
-        this.resizeElement_(this.popupDetailedElement,
-                            this.targetPosX, this.targetPosY,
-                            this.targetWidth, false);
-        this.popupDetailedElement.style.display = 'block';
-        this.popupDetailedElement.innerHTML = "<a href='http://dnede.com' id='select_target'>Select</a>";
-        this.popupDetailedElement.style.visibility = 'visible';
-        this.visible = true;
-        this.delayed = false;
-      };
-
-      PersonPopup.prototype.hide_ = function() {
-        this.hideTimerID = -1;
-        this.popupDetailedElement.style.display = 'none';
-        this.visible = false;
-        this.delayed = false;
-      };
-
-      PersonPopup.prototype.handleAnchorMouseMove_ = function(e) {
-        e = e || window.event;
-
-        var targetElement = (e.target) ? e.target : e.srcElement;
-
-        this.pointerOnTargetElement = true;
-
-        if (targetElement == this.targetElement) {
-          this.x = this.getPointerX_(e);
-          this.y = this.getPointerY_(e);
-
-        } else {
-          this.handleAnchorMouseOver_(e);
-        }
-      };
-
-      PersonPopup.prototype.handleAnchorMouseOver_ = function(e) {
-        e = e || window.event;
-        var targetElement = (e.target) ? e.target : e.srcElement;
-
-        if (this.visible &&
-            (targetElement == this.targetElement) &&
-            (this.hideTimerID == -1)) {
-          return;
-        }
-
-        this.x = this.getPointerX_(e);
-        this.y = this.getPointerY_(e);
-
-        if (this.visible &&
-            (targetElement != this.targetElement) &&
-            (this.pointerCloseEnough_(this.x, this.y))) {
-          return;
-        }
-
-        if (this.delayed && (this.targetElement == targetElement)) {
-          return;
-        }
-
-        this.targetElement = targetElement;
-        var screenWidth = self.innerWidth;
-        var screenHeight = self.innerHeight;
-        var scrollTop = document.documentElement.scrollTop;
-        var scrollLeft = document.documentElement.scrollLeft;
-        this.targetWidth = 12.7 * 26;
-        this.targetHeight = 12.7 * 13;
-        this.targetPosX = Math.floor(this.x + 15);
-        this.targetPosY = Math.floor(this.y + 20);
-
-        if (this.showTimerID != -1) {
-          window.clearTimeout(this.showTimerID);
-        }
-
-        if (this.visible) {
-          this.popupDetailedElement.style.display = 'none';
-          this.showTimerID =
-            window.setTimeout(MPP_bind(this.show_, this), 200);
-        } else {
-          this.showTimerID =
-            window.setTimeout(MPP_bind(this.show_, this), 350);
-        }
-
-        this.delayed = true;
-        this.pointerOutsidePopup = true;
-      };
-
-      PersonPopup.prototype.handleMouseOut_ = function(e) {
-        if ((this.delayed) || (this.visible)) {
-
-          this.pointerOnTargetElement = false;
-
-          e = e || window.event;
-
-          if (e) {
-            var from = null;
-
-            if (e.relatedTarget) {
-              from = e.relatedTarget;
-            } else if (e.toElement) {
-              from = e.toElement;
-            }
-
-            var targetElement = (e.target) ? e.target : e.srcElement;
-
-            try {
-              if ((from == null) || (from.tagName == 'HTML') ||
-                  (from.tagName.substring(0, 3) == 'xul')) {
-                this.hideTimerID =
-                  window.setTimeout(MPP_bind(this.hide_, this),
-                                    200);
-              }
-            } catch(e) {
-
-            }
-          }
-        }
-      };
-
-      PersonPopup.prototype.handleOnLoad_ = function(e) {
-        e = e || window.event;
-        this.popupDetailedElement = document.createElement('div');
-        this.popupDetailedElement.
-            setAttribute('id','popup_detailed');
-        this.popupDetailedElement.className = 'popup';
-        this.popupDetailedElement.style.display = 'none';
-        this.popupDetailedElement.style.position = 'absolute';
-        this.popupDetailedElement.innerHTML = '&nbsp;';
-        document.body.appendChild(this.popupDetailedElement);
-
-        document.body.onmousemove = MPP_bind(this.handleMouseMove_, this);
-        document.body.onmouseout = MPP_bind(this.handleMouseOut_, this);
-        this.enablePopupsForChildElements(document);
-        
-        runTest1();
-      };
-
-      PersonPopup.prototype.enablePopupsForChildElements = function(el) {
-        var els = el.getElementsByTagName('*');
-
-        for (var i = 0, item; item = els[i]; i++) {
-          if (item.className.indexOf('showPersonPopup') != -1) {
-            item.onmouseover = MPP_bind(this.handleAnchorMouseOver_, this);
-            item.onmousemove = MPP_bind(this.handleAnchorMouseMove_, this);
-          }
-        }
-      };
-      
-      var personPopup = new PersonPopup();
-    </script>
-  </head>
-  <body>
-    <p class="byline">
-        <a class="showPersonPopup" id="mouse_target" href="dummy">Mouse Over</a>
-    </p>
-    <div id="log_div">
-      This test checks the fix for https://bugs.webkit.org/show_bug.cgi?id=18506. To test it manually:
-      <li/> Hover mouse over "Mouse Over" link
-      <li/> Quickly jump to the yellow box that pops up and select "Select" link
-      <li/> Move mouse away so that pop up disappears
-      <li/> Press the "Copy" keyboard accelerator - this should not cause any crash
-    </div>
-  </body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/copy-standalone-image-crash.html b/tests/tests/webkitsecurity/assets/copy-standalone-image-crash.html
deleted file mode 100644
index 18522b5..0000000
--- a/tests/tests/webkitsecurity/assets/copy-standalone-image-crash.html
+++ /dev/null
@@ -1,68 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<script>
-
-var actionitems;
-
-if (window.layoutTestController) {
-     window.layoutTestController.dumpAsText();
-     window.layoutTestController.waitUntilDone();
-}
-
-function doClick() {
-    for (var i = 0; i < actionitems.length; i++)
-    {
-        var title = actionitems[i].title;
-
-        if (!title)
-           break;
-
-        title = title.replace(/_/g,'');
-
-        if (title.match("Copy Image")) {
-           actionitems[i].click();
-           break;
-        }
-    }
-
-    document.body.innerHTML = "PASS";
-
-    window.layoutTestController.notifyDone();
-}
-
-function hideDiv() {
-    document.getElementById("DIV").style.display="none";
-}
-
-function doTest() {
-    if (!window.layoutTestController) {
-        document.body.addEventListener('mousedown', function () {setTimeout(hideDiv, 100)}, false);
-        return;
-    }
-
-    var image = document.getElementById("IMG");
-
-    x = image.offsetLeft + 10;
-    y = image.offsetTop + 10;
-
-    eventSender.mouseMoveTo(x, y);
-    actionitems = eventSender.contextClick();
-
-    hideDiv();
-
-    setTimeout(doClick, 10);
-}
-
-</script>
-</head>
-<body onload="doTest()">
-This is an automated test case for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=31721">31721</a><br>
-If you wish to test manually, mouseover to image, activate context menu, wait for the image to disappear and then click copy image.<br>
-There should be no crash.
-<div ID="DIV">
-    <img id="IMG" src="resources/apple.gif"/>
-    </div>
-</body>
-
-</html>
diff --git a/tests/tests/webkitsecurity/assets/copy-without-common-block-crash.html b/tests/tests/webkitsecurity/assets/copy-without-common-block-crash.html
deleted file mode 100644
index 21c078f..0000000
--- a/tests/tests/webkitsecurity/assets/copy-without-common-block-crash.html
+++ /dev/null
@@ -1,18 +0,0 @@
-<html>
-<body>
-<p>This tests crash when copying a text without a common ancestor block. To manually test, copy "hello" below and WebKit should not crash. On DRT, you should see PASS below.</p>
-<span id="test" contenteditable>hello</span>
-<script type="text/javascript">
-
-if (window.layoutTestController)
-    window.layoutTestController.dumpAsText();
-
-var test = document.getElementById('test');
-document.getSelection().selectAllChildren(test);
-document.execCommand('copy');
-
-test.innerHTML = 'PASS';
-
-</script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/counter-after-style-crash.html b/tests/tests/webkitsecurity/assets/counter-after-style-crash.html
deleted file mode 100644
index 8a0af67..0000000
--- a/tests/tests/webkitsecurity/assets/counter-after-style-crash.html
+++ /dev/null
@@ -1,32 +0,0 @@
-<html>
-  <script>
-  if (window.layoutTestController) {
-    layoutTestController.waitUntilDone();
-    layoutTestController.dumpAsText();
-  }
-  </script>
-  <style>
-    div {
-      counter-reset:ctr
-    }
-
-    :after {
-      content:counter(x);
-      counter-increment:ctr;
-    }
-  </style>                          
-  <junk>TESTING..</div><div><div></div>
-  <span></span>
-  <table>
-    </script>
-    <script>
-      document.designMode='on';
-      document.execCommand('selectall');
-      document.execCommand('italic');
-      document.execCommand('removeformat');
-
-      document.body.innerHTML = "PASS: Counters updated successfully without crashing";
-      layoutTestController.notifyDone();
-    </script>
-  </table>
-</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/counter-before-selector-crash.html b/tests/tests/webkitsecurity/assets/counter-before-selector-crash.html
deleted file mode 100644
index cbc8bc5..0000000
--- a/tests/tests/webkitsecurity/assets/counter-before-selector-crash.html
+++ /dev/null
@@ -1,26 +0,0 @@
-<html>
-    <head>
-        <style>
-            div.example:before {
-                content: counter(exampleno, upper-roman);
-                counter-increment: exampleno;
-            }
-            pre.example:before {
-                content: counter(exampleno, upper-roman);
-                counter-increment: exampleno;
-            }
-        </style>
-        <script>
-            function test()
-            {
-                if (window.layoutTestController)
-                    layoutTestController.dumpAsText();
-            }
-        </script>
-    </head>
-    <body onload="test()">
-        This tests that we don't crash when using the CSS counters feature.
-        <div class="example"></div>
-        <pre class="example"></pre>
-    </body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/counter-crash-frame-src.html b/tests/tests/webkitsecurity/assets/counter-crash-frame-src.html
deleted file mode 100644
index a2ba184..0000000
--- a/tests/tests/webkitsecurity/assets/counter-crash-frame-src.html
+++ /dev/null
@@ -1,22 +0,0 @@
-

-<script>

-function boom() {

-    var p = document.getElementById('p').cloneNode(false);

-    document.getElementById('fig').appendChild(p);

-

-    var count = document.getElementById('count').cloneNode(false);

-    document.getElementById('multi').appendChild(count);

-

-    document.location.reload();

-}

-</script>

-<body onload="boom();">

-    <spacer id='count' style='counter-increment: aaa 1;'>

-        <fig id='fig'>

-    </spacer>

-    <acronym>

-        <spacer style='counter-increment: aaa 1;'></spacer>

-    </acronym>

-    <multicol id='multi'></multicol>

-    <p id='p'></p>

-</body>

diff --git a/tests/tests/webkitsecurity/assets/counter-crash.html b/tests/tests/webkitsecurity/assets/counter-crash.html
deleted file mode 100644
index 374806b..0000000
--- a/tests/tests/webkitsecurity/assets/counter-crash.html
+++ /dev/null
@@ -1,16 +0,0 @@
-<html>

-    <script>

-        window.onload = function()

-        {

-            if (window.layoutTestController)

-                layoutTestController.dumpAsText();

-

-            document.getElementById('content').innerHTML = "PASS: rendered counter nodes without crashing.";

-        }

-    </script>

-    <iframe src='resources/counter-crash-frame-src.html'>

-    </iframe>

-    <div id='content'>

-    FAIL

-    </div>

-</html>

diff --git a/tests/tests/webkitsecurity/assets/counter-reparent-table-children-crash.html b/tests/tests/webkitsecurity/assets/counter-reparent-table-children-crash.html
deleted file mode 100644
index 87d6aef..0000000
--- a/tests/tests/webkitsecurity/assets/counter-reparent-table-children-crash.html
+++ /dev/null
@@ -1,31 +0,0 @@
-<html>

-<style>

-td {

-    counter-increment: list-item;

-}

-</style>

-<script>

-if (window.layoutTestController) {

-    layoutTestController.waitUntilDone();

-}

-

-function crash() {

-    document.body.innerHTML = "PASS: Malformed table counters do not cause crash";

-    if (window.layoutTestController) {

-        layoutTestController.notifyDone();

-        layoutTestController.dumpAsText();

-    }

-}

-</script>

-<body onload="crash()">

-    <table>

-        <tbody>

-            <td>

-        </tbody>

-        <ol>re-parent me</ol>

-        <ol>re-parent me</ol>

-            </td>

-        <td></td>

-    </table>

-</body>

-</html>

diff --git a/tests/tests/webkitsecurity/assets/counter-traverse-object-crash.html b/tests/tests/webkitsecurity/assets/counter-traverse-object-crash.html
deleted file mode 100644
index 5ad3656..0000000
--- a/tests/tests/webkitsecurity/assets/counter-traverse-object-crash.html
+++ /dev/null
@@ -1,17 +0,0 @@
-<html>
-    <script>
-        function test()
-        {
-            if (window.layoutTestController)
-                layoutTestController.dumpAsText();
-            document.getElementsByTagName("div")[0].outerHTML = "PASS";
-        }
-    </script>
-    This tests that we do not crash when RenderCounter traverses detached render trees.
-    <body onload="test()" style="counter-increment: ctr">
-        <object>
-            <b style="counter-increment: ctr"><div></div></b>
-            <menu style="counter-increment: ctr"></menu>
-        </object>
-    </body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-1.html b/tests/tests/webkitsecurity/assets/crash-1.html
deleted file mode 100644
index 5722427..0000000
--- a/tests/tests/webkitsecurity/assets/crash-1.html
+++ /dev/null
@@ -1,13 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script>
-description("KDE JS Test");
-</script>
-<script src="script-tests/crash-1.js"></script>
-<script src="../resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-1.js b/tests/tests/webkitsecurity/assets/crash-1.js
deleted file mode 100644
index acd5584..0000000
--- a/tests/tests/webkitsecurity/assets/crash-1.js
+++ /dev/null
@@ -1,8 +0,0 @@
-// infinite recursion
-try {
-  var v = [];
-  v[0] = v;
-  v.toString();
-} catch (e) {
-  debug("OK. Caught an exception.");
-}
diff --git a/tests/tests/webkitsecurity/assets/crash-2.html b/tests/tests/webkitsecurity/assets/crash-2.html
deleted file mode 100644
index 3bf39e5..0000000
--- a/tests/tests/webkitsecurity/assets/crash-2.html
+++ /dev/null
@@ -1,13 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script>
-description("KDE JS Test");
-</script>
-<script src="script-tests/crash-2.js"></script>
-<script src="../resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-2.js b/tests/tests/webkitsecurity/assets/crash-2.js
deleted file mode 100644
index 5ae3188..0000000
--- a/tests/tests/webkitsecurity/assets/crash-2.js
+++ /dev/null
@@ -1,10 +0,0 @@
-// infinite recursion 2
-function foo() {
-   foo();
-}
-
-try {
-  foo();
-} catch (e) {
-  debug("OK. Caught an exception");
-}
diff --git a/tests/tests/webkitsecurity/assets/crash-HTMLParser-createHead.html b/tests/tests/webkitsecurity/assets/crash-HTMLParser-createHead.html
deleted file mode 100644
index d6f7407..0000000
--- a/tests/tests/webkitsecurity/assets/crash-HTMLParser-createHead.html
+++ /dev/null
@@ -1,15 +0,0 @@
-<body onload=go();></body>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    function go() {
-        document.open();
-        try {
-            new Image().insertAdjacentHTML(0,"<x<meta>");
-        } catch (e) {
-        }
-        document.write('<p>Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=32426">32426</a>: Crash in WebCore::HTMLParser::createHead</p>');
-        document.write('<p>This test PASSED as it did not CRASH nor ASSERTED.</p>');
-    }
-</script>
diff --git a/tests/tests/webkitsecurity/assets/crash-accessing-clipboardData-types.html b/tests/tests/webkitsecurity/assets/crash-accessing-clipboardData-types.html
deleted file mode 100644
index 60d0358..0000000
--- a/tests/tests/webkitsecurity/assets/crash-accessing-clipboardData-types.html
+++ /dev/null
@@ -1,20 +0,0 @@
-<body>
-
-<p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=30150">bug 30150</a> Crash when accessing clipboardData.types</p>
-<p>PASS if didn't crash.</p>
-
-<div contenteditable id=d>Test</div>
-
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-document.body.addEventListener("paste", function(e){ e.clipboardData.types }, true);
-
-document.getElementById("d").focus();
-document.execCommand("SelectAll");
-document.execCommand("Cut");
-document.execCommand("Paste");
-
-</script>
-</body>
diff --git a/tests/tests/webkitsecurity/assets/crash-anonymous-table-computeLogicalWidth.html b/tests/tests/webkitsecurity/assets/crash-anonymous-table-computeLogicalWidth.html
deleted file mode 100755
index f1a9ec8..0000000
--- a/tests/tests/webkitsecurity/assets/crash-anonymous-table-computeLogicalWidth.html
+++ /dev/null
@@ -1,17 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<style>
-.tableBefore:before { display: inline-table; content: url(data:text/plain,foo); width: 10px; }
-</style>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-</head>
-<body>
-<div class="tableBefore"></div>
-<div>Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=70392">70392</a>: Multiple crashes in RenderTable during layout</div>
-<div>This test passes if it does not CRASH.</div>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-anonymous-table-layout.html b/tests/tests/webkitsecurity/assets/crash-anonymous-table-layout.html
deleted file mode 100755
index 4451384..0000000
--- a/tests/tests/webkitsecurity/assets/crash-anonymous-table-layout.html
+++ /dev/null
@@ -1,17 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<style>
-.tableAfter::after { display: table; content: attr(class); height: 1px; }
-</style>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-</head>
-<body>
-<div class="tableAfter"></div>
-<div>Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=70392">70392</a>: Multiple crashes in RenderTable during layout</div>
-<div>This test passes if it does not CRASH.</div>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-beforeBorder-dirty-section.html b/tests/tests/webkitsecurity/assets/crash-beforeBorder-dirty-section.html
deleted file mode 100644
index 7ca2358..0000000
--- a/tests/tests/webkitsecurity/assets/crash-beforeBorder-dirty-section.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<style>
-    #el1 {
-        border-collapse: collapse;
-        -webkit-writing-mode: vertical-rl;
-    }
-</style>
-</head>
-<body>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    var wrapper = document.createElement('div');
-    wrapper.style.display = 'inline-block';
-    document.body.appendChild(wrapper);
-    var table = document.createElement('table');
-    table.setAttribute('id', 'el1');
-    wrapper.appendChild(table);
-    tbody = document.createElement('tbody');
-    tbody.setAttribute('id', 'el2');
-    table.appendChild(tbody);
-
-    function crash() {
-        tbody.style.display = 'table';
-        document.body.innerHTML = "<a href='https://bugs.webkit.org/show_bug.cgi?id=75215'>Bug 75215: Crash in RenderTable::borderBefore<a><br>This test has passed!";
-    }
-
-    window.addEventListener('load', crash, false);
-</script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-breaking-blockquote-with-list.html b/tests/tests/webkitsecurity/assets/crash-breaking-blockquote-with-list.html
deleted file mode 100644
index 3f22ead..0000000
--- a/tests/tests/webkitsecurity/assets/crash-breaking-blockquote-with-list.html
+++ /dev/null
@@ -1,20 +0,0 @@
-<!DOCTYPE html>
-<body>
-<div id="description">This test assures that inserting a newline in a list nested in a blockquote doesn't crash.</div>
-<div contenteditable="true" id="container">
-<blockquote type="cite">
-    <ol><li style=" -webkit-appearance: relevancy-level-indicator" id="two">TwoTwo</li></ol>
-</blockquote>
-</div>
-<script>
-    li = document.getElementById("two");
-    text = li.firstChild;
-    selection = window.getSelection();
-    selection.setPosition(text, 3);
-    document.execCommand("InsertNewlineInQuotedContent");
-    var div = document.getElementById("container");
-    div.parentNode.removeChild(div);
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-</body>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/crash-button-input-autofocus.html b/tests/tests/webkitsecurity/assets/crash-button-input-autofocus.html
deleted file mode 100755
index 4763ff3..0000000
--- a/tests/tests/webkitsecurity/assets/crash-button-input-autofocus.html
+++ /dev/null
@@ -1,14 +0,0 @@
-<html>
-<body>
-<p style="visibility: collapse;"><button><input autofocus><input id="test"></input></button></p>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-document.body.offsetTop;
-document.getElementById('test').parentNode.removeChild(document.getElementById('test'));
-document.body.offsetTop;
-</script>
-<p>Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=63776">63776</a>: Partial layout when a flex-box has visibility: collapse</p>
-<p>This test PASSES if it does not CRASH.</p>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-button-keygen.html b/tests/tests/webkitsecurity/assets/crash-button-keygen.html
deleted file mode 100755
index 7cf441e..0000000
--- a/tests/tests/webkitsecurity/assets/crash-button-keygen.html
+++ /dev/null
@@ -1,14 +0,0 @@
-<html>
-<body>
-<p style="visibility: collapse;"><button><keygen autofocus><input id="test"></keygen></button></p>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-document.body.offsetTop;
-document.getElementById('test').parentNode.removeChild(document.getElementById('test'));
-document.body.offsetTop;
-</script>
-<p>Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=63776">63776</a>: Partial layout when a flex-box has visibility: collapse</p>
-<p>This test PASSES if it does not CRASH.</p>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-button-relayout.html b/tests/tests/webkitsecurity/assets/crash-button-relayout.html
deleted file mode 100755
index 49a6d2a..0000000
--- a/tests/tests/webkitsecurity/assets/crash-button-relayout.html
+++ /dev/null
@@ -1,14 +0,0 @@
-<html>
-<body>
-<p style="visibility: collapse;"><button><input><script>document.getElementsByTagName('input')[0].offsetTop;</script><input id="test"></input></button></p>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-document.body.offsetTop;
-document.getElementById('test').parentNode.removeChild(document.getElementById('test'));
-document.body.offsetTop;
-</script>
-<p>Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=63776">63776</a>: Partial layout when a flex-box has visibility: collapse</p>
-<p>This test PASSES if it does not CRASH.</p>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-closing-page-with-media-as-plugin-fallback.html b/tests/tests/webkitsecurity/assets/crash-closing-page-with-media-as-plugin-fallback.html
deleted file mode 100644
index b567536..0000000
--- a/tests/tests/webkitsecurity/assets/crash-closing-page-with-media-as-plugin-fallback.html
+++ /dev/null
@@ -1,41 +0,0 @@
-<script>
-var childWindow;
-</script>
-This test makes sure that closing a window with a video element that has a poster image doesn't crash (radar 10576732 and https://bugs.webkit.org/show_bug.cgi?id=74533)<br>
-If it doesn't crash, it passes.<br>
-<button id="button" onclick="childWindow = window.open('resources/video-with-poster-as-object-fallback.html')">
-    Click here to open test window
-</button><br>
-<div id="result"></div><br>
-
-<script>
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-    layoutTestController.overridePreference("WebKitUsesPageCachePreferenceKey", 1);
-    layoutTestController.overridePreference("WebKitPageCacheSupportsPluginsPreferenceKey", 1);
-    layoutTestController.setCanOpenWindows(true);
-    layoutTestController.setCloseRemainingWindowsWhenComplete(true);
-    var button = document.getElementById("button");
-    eventSender.mouseMoveTo(button.offsetParent.offsetLeft + button.offsetLeft + button.offsetWidth / 2, button.offsetParent.offsetTop +  button.offsetTop + button.offsetHeight / 2);
-    eventSender.mouseDown();
-    eventSender.mouseUp();
-}
-
-function childLoaded()
-{
-    childWindow.close();
-    setTimeout("checkClosed()", 0);
-}
-
-function checkClosed()
-{
-    if (childWindow.closed) {
-        document.getElementById("result").innerText = "Closed the window without crashing!";
-        if (window.layoutTestController)
-            setTimeout("layoutTestController.notifyDone();", 0);
-    }
-    setTimeout("checkClosed()", 0);
-}
-
-</script>
diff --git a/tests/tests/webkitsecurity/assets/crash-copying-backforwardlist.html b/tests/tests/webkitsecurity/assets/crash-copying-backforwardlist.html
deleted file mode 100644
index 511c139..0000000
--- a/tests/tests/webkitsecurity/assets/crash-copying-backforwardlist.html
+++ /dev/null
@@ -1,20 +0,0 @@
-<html>
-<head>
-<script>
-
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-    layoutTestController.setCanOpenWindows(true);
-    layoutTestController.setNewWindowsCopyBackForwardList(true);
-}
-
-</script>
-</head>
-<body onload="window.open('data:text/html,<script>if (window.layoutTestController) layoutTestController.notifyDone();</script>');">
-<pre>
-This test only works in DRT by tickling the [WebView _loadBackForwardListFromOtherView:] method.
-If it doesn't crash, then the test passes.
-</pre>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-css-generated-content.xhtml b/tests/tests/webkitsecurity/assets/crash-css-generated-content.xhtml
deleted file mode 100644
index b905b3a..0000000
--- a/tests/tests/webkitsecurity/assets/crash-css-generated-content.xhtml
+++ /dev/null
@@ -1,27 +0,0 @@
-<!DOCTYPE html
-  PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
-  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html lang="en-US" xml:lang="en-US" xmlns="http://www.w3.org/1999/xhtml">
-    <style>
-        svg text:before {
-            content: 'FAIL';
-        }
-        svg text:after {
-            content: 'FAIL';
-        }
-    </style>
-    <head>
-        <title>Test case for rdar://6302405</title>
-    </head>
-    <body>
-        <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
-            <text x="50" y="50">This test ensures that we do not crash when css generated content attempts to attach to svg text</text>
-        </svg>
-        <script>
-        <![CDATA[
-            if (window.layoutTestController)
-                layoutTestController.dumpAsText();
-        ]]>
-        </script>
-    </body>
-</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/crash-determining-aria-role-when-label-present.html b/tests/tests/webkitsecurity/assets/crash-determining-aria-role-when-label-present.html
deleted file mode 100644
index 9521b58..0000000
--- a/tests/tests/webkitsecurity/assets/crash-determining-aria-role-when-label-present.html
+++ /dev/null
@@ -1,30 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../fast/js/resources/js-test-pre.js"></script>
-</head>
-<body id="body">
-
-<label><q role=x><input id="test">
-
-<p id="description"></p>
-<div id="console"></div>
-
-<script>
-
-    description("This tests a crashing scenario where an element with a role attribute is a child of a label that also has a corresponding control.");
-
-    if (window.accessibilityController) {
-          document.getElementById("test").focus();
-         
-          // This line should not crash.
-          var input = accessibilityController.focusedElement;
-
-          shouldBe("input.childrenCount", "0");
-    }
-
-</script>
-
-<script src="../fast/js/resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-display-local-directory.html b/tests/tests/webkitsecurity/assets/crash-display-local-directory.html
deleted file mode 100644
index 7fa0cb9..0000000
--- a/tests/tests/webkitsecurity/assets/crash-display-local-directory.html
+++ /dev/null
@@ -1,26 +0,0 @@
-<html>
-<head>
-    <title>Test crash on directory display</title>
-    <script>
-        function directoryTest() {
-            if (window.layoutTestController)
-                layoutTestController.dumpAsText();
-
-            var result = document.getElementById("result");
-
-            var directoryDocument = document.getElementById("myDirectory").contentDocument;
-            if (directoryDocument)
-              result.innerHTML = "PASS: Local directory loaded.";
-            else
-              result.innerHTML = "FAIL: Local directory cannot be listed.";
-        }
-    </script>
-</head>
-<body>
-    <p>This test is to see if a local directory index can be diplayed.</p>
-    <p id="result">
-        Test has not run.
-    </p>
-    <iframe id="myDirectory" src="resources/directory" width="600px" height="400px" onload="directoryTest()"/>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-empty-section-calcBorder.html b/tests/tests/webkitsecurity/assets/crash-empty-section-calcBorder.html
deleted file mode 100644
index 8bb0c6c..0000000
--- a/tests/tests/webkitsecurity/assets/crash-empty-section-calcBorder.html
+++ /dev/null
@@ -1,24 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    function crash() {
-        var firstBody = document.getElementById("firstBody");
-        firstBody.removeChild(firstBody.firstChild);
-        firstBody.offsetTop;
-    }
-
-    window.addEventListener("load", crash, false);
-</script>
-</head>
-<body>
-<p>Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=71246">71246</a>: REGRESSION(98738): Multiple crashes in the table rendering code</p>
-<p>This test PASSES if it does not CRASH.</p>
-<table style="border-collapse: collapse">
-    <tbody id="firstBody" style="border: 2px solid green"><tr style="border: 4px solid red"></tr></tbody>
-</table>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-empty-section-fixed-layout-calcArray.html b/tests/tests/webkitsecurity/assets/crash-empty-section-fixed-layout-calcArray.html
deleted file mode 100644
index e58ac95..0000000
--- a/tests/tests/webkitsecurity/assets/crash-empty-section-fixed-layout-calcArray.html
+++ /dev/null
@@ -1,24 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    function crash() {
-        var firstBody = document.getElementById("firstBody");
-        firstBody.removeChild(firstBody.firstChild);
-        firstBody.offsetTop;
-    }
-
-    window.addEventListener("load", crash, false);
-</script>
-</head>
-<body>
-<p>Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=71246">71246</a>: REGRESSION(98738): Multiple crashes in the table rendering code</p>
-<p>This test PASSES if it does not CRASH.</p>
-<table style="table-layout:fixed; width:0;">
-    <tbody id="firstBody"><tr></tr></tbody>
-</table>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-filter-change-expected.png b/tests/tests/webkitsecurity/assets/crash-filter-change-expected.png
deleted file mode 100644
index b3003d0..0000000
--- a/tests/tests/webkitsecurity/assets/crash-filter-change-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/crash-filter-change.html b/tests/tests/webkitsecurity/assets/crash-filter-change.html
deleted file mode 100644
index cf77b18..0000000
--- a/tests/tests/webkitsecurity/assets/crash-filter-change.html
+++ /dev/null
@@ -1,19 +0,0 @@
-<!DOCTYPE html>
-<!-- Test passes if doesn't crash. -->
-<style>
-.first {
-    -webkit-filter: hue-rotate(90deg);
-}
-.second {
-    -webkit-filter: blur(3px);
-}
-</style>
-<img class='first' src="resources/reference.png">
-<script>
-    if (window.layoutTestController)
-        window.layoutTestController.dumpAsText(true);
-    // force a layout
-    document.body.offsetTop;
-    var img = document.getElementsByTagName('img')[0];
-    img.className = 'second';
-</script>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/crash-flexbox-no-layout-child.html b/tests/tests/webkitsecurity/assets/crash-flexbox-no-layout-child.html
deleted file mode 100644
index 636505e..0000000
--- a/tests/tests/webkitsecurity/assets/crash-flexbox-no-layout-child.html
+++ /dev/null
@@ -1,20 +0,0 @@
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function boom() {
-  setTimeout('document.querySelector("progress").setAttribute("style", "overflow: scroll; border-style: dotted;");', 10);
-}
-window.onload = boom;
-</script>
-<body>
-  <span style="display: -webkit-inline-box;">
-    <span style="position: fixed; visibility: collapse;">
-      <span style="visibility: visible;">
-        <progress></progress>
-      </span>
-    </span>
-  </span>
-  <div>Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=64842">64842</a>: RenderDeprecatedFlexibleBox does not call its children's layout method</div>
-  <div>This test passes if it does not CRASH.</div>
-</body>
diff --git a/tests/tests/webkitsecurity/assets/crash-frameset-CSS-content-property.html b/tests/tests/webkitsecurity/assets/crash-frameset-CSS-content-property.html
deleted file mode 100644
index b497b64..0000000
--- a/tests/tests/webkitsecurity/assets/crash-frameset-CSS-content-property.html
+++ /dev/null
@@ -1,38 +0,0 @@
-<html>
-<head>
-<title>WebKit Bug 47314</title>
-<script>
-function runTest()
-{
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    var frameset = document.getElementById("frameset");
-    var mouseClick = document.createEvent("MouseEvent");
-    mouseClick.initEvent("click", true, true);
-    frameset.dispatchEvent(mouseClick);
-
-    if (!window.layoutTestController) {
-        // For some reason, when running this test by hand in release builds you must manually
-        // click on the not-found image placeholder to cause a crash. Hence, we don't replace
-        // the <frameset> and print a PASS message.
-        return;
-    }
-
-    // As per the definition of the body element in section 3.1.4 the HTML 5 spec.
-    // <http://www.w3.org/TR/html5/dom.html#the-body-element>, a document can either
-    // have a <frameset> or a <body>, but not both, and a frameset does not provide
-    // a means to print a PASS message. Therefore, we replace <frameset> with <body>.
-    var htmlElement = document.getElementsByTagName("html")[0];
-    htmlElement.replaceChild(document.createElement("body"), frameset);
-    document.body.appendChild(document.createTextNode("PASS, mouse event to <frameset> did not cause crash."));
-}
-
-window.onload = runTest;
-</script>
-</head>
-<!-- This tests that we don't crash when clicking on a <frameset> that specifies the CSS content property. -->
-<!-- This test PASSED if you see the word "PASS" on the page. Otherwise, it FAILED. -->
-<!-- Note: If you are running this test by hand in a release build then try clicking on the not-found image placeholder to cause a crash. -->
-<frameset id="frameset" style="content:url(click-to-crash.jpg)"></frameset>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-generated-counter.html b/tests/tests/webkitsecurity/assets/crash-generated-counter.html
deleted file mode 100755
index 7d7deaa..0000000
--- a/tests/tests/webkitsecurity/assets/crash-generated-counter.html
+++ /dev/null
@@ -1,23 +0,0 @@
-<html>
-    <body>
-        <style>
-            div:before
-            {
-                counter-reset: foobar;
-                content: counter(foobar, upper-roman);
-                display: block;
-                overflow: hidden;
-                width: 100;
-                height: 100;
-            }
-        </style>
-        Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=61411">61411</a>: ASSERTION FAILED: !m_layoutRoot->container() || !m_layoutRoot->container()->needsLayout() with generated content<br>
-        Test passes if it does not crash.
-        <script>
-            if (window.layoutTestController)
-                layoutTestController.dumpAsText();
-
-            document.body.offsetTop;
-        </script><div></div>
-    </body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-generated-image.html b/tests/tests/webkitsecurity/assets/crash-generated-image.html
deleted file mode 100755
index 63aec66..0000000
--- a/tests/tests/webkitsecurity/assets/crash-generated-image.html
+++ /dev/null
@@ -1,22 +0,0 @@
-<html>
-    <body>
-        <style>
-            div:before
-            {
-                content: url(resources/greenbox.png);
-                display: block;
-                overflow: hidden;
-                width: 100;
-                height: 100;
-            }
-        </style>
-        Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=61411">61411</a>: ASSERTION FAILED: !m_layoutRoot->container() || !m_layoutRoot->container()->needsLayout() with generated content<br>
-        Test passes if it does not crash.
-        <script>
-            if (window.layoutTestController)
-                layoutTestController.dumpAsText();
-
-            document.body.offsetTop;
-        </script><div></div>
-    </body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-generated-quote.html b/tests/tests/webkitsecurity/assets/crash-generated-quote.html
deleted file mode 100755
index 96915827..0000000
--- a/tests/tests/webkitsecurity/assets/crash-generated-quote.html
+++ /dev/null
@@ -1,22 +0,0 @@
-<html>
-    <body>
-        <style>
-            div:before
-            {
-                content: open-quote;
-                display: block;
-                overflow: hidden;
-                width: 100;
-                height: 100;
-            }
-        </style>
-        Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=61411">61411</a>: ASSERTION FAILED: !m_layoutRoot->container() || !m_layoutRoot->container()->needsLayout() with generated content<br>
-        Test passes if it does not crash.
-        <script>
-            if (window.layoutTestController)
-                layoutTestController.dumpAsText();
-
-            document.body.offsetTop;
-        </script><div></div>
-    </body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-generated-text.html b/tests/tests/webkitsecurity/assets/crash-generated-text.html
deleted file mode 100755
index 4b38e7c..0000000
--- a/tests/tests/webkitsecurity/assets/crash-generated-text.html
+++ /dev/null
@@ -1,22 +0,0 @@
-<html>
-    <body>
-        <style>
-            div:before
-            {
-                content: 'PASS';
-                display: block;
-                overflow: hidden;
-                width: 100;
-                height: 100;
-            }
-        </style>
-        Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=61411">61411</a>: ASSERTION FAILED: !m_layoutRoot->container() || !m_layoutRoot->container()->needsLayout() with generated content<br>
-        Test passes if it does not crash.
-        <script>
-            if (window.layoutTestController)
-                layoutTestController.dumpAsText();
-
-            document.body.offsetTop;
-        </script><div></div>
-    </body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-huge-layer.html b/tests/tests/webkitsecurity/assets/crash-huge-layer.html
deleted file mode 100644
index 15c5474..0000000
--- a/tests/tests/webkitsecurity/assets/crash-huge-layer.html
+++ /dev/null
@@ -1,7 +0,0 @@
-<!DOCTYPE html>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-<p>This is a test for <a href="https://bugs.webkit.org/show_bug.cgi?id=65637">Bug 65637: Crash beneath PlatformCALayerWinInternal::updateTiles when zooming on Google Maps</a>. The test passes if the browser does not crash.</p>
-<div style="width: 33554432px; height: 33554432px; -webkit-transform: translateZ(0);">Did you crash?</div>
diff --git a/tests/tests/webkitsecurity/assets/crash-hw-sw-switch-expected.png b/tests/tests/webkitsecurity/assets/crash-hw-sw-switch-expected.png
deleted file mode 100644
index 89ffdbe..0000000
--- a/tests/tests/webkitsecurity/assets/crash-hw-sw-switch-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/crash-hw-sw-switch.html b/tests/tests/webkitsecurity/assets/crash-hw-sw-switch.html
deleted file mode 100644
index 8731c7f..0000000
--- a/tests/tests/webkitsecurity/assets/crash-hw-sw-switch.html
+++ /dev/null
@@ -1,24 +0,0 @@
-<!DOCTYPE html>
-<!-- Test passes if doesn't crash. -->
-<style>
-.sw {
-    -webkit-filter: blur(4px);
-}
-.hw {
-    -webkit-filter: blur(3px);
-    -webkit-transform:translateZ(0);
-}
-</style>
-<img class='sw' src="resources/reference.png">
-PASS if test does not crash or cause an ASSERT failure.
-<script>
-    if (window.layoutTestController)
-        window.layoutTestController.dumpAsText(true);
-    // force a layout
-    document.body.offsetTop;
-    var img = document.getElementsByTagName('img')[0];
-    img.className = 'hw';
-    // force a layout
-    document.body.offsetTop;
-    img.className = 'sw';
-</script>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/crash-in-element-for-text-marker.html b/tests/tests/webkitsecurity/assets/crash-in-element-for-text-marker.html
deleted file mode 100644
index 488c72f..0000000
--- a/tests/tests/webkitsecurity/assets/crash-in-element-for-text-marker.html
+++ /dev/null
@@ -1,44 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../../fast/js/resources/js-test-pre.js"></script>
-</head>
-<body id="body">
-
-asdf
-
-<div id="content" tabindex="0">test</div>
-
-asdf
-
-<p id="description"></p>
-<div id="console"></div>
-
-<script>
-
-    description("This protects against a crash when AXUIElementForTextMarker is queried with an empty text marker.");
-
-    if (window.accessibilityController) {
-
-          document.getElementById("content").focus();
-          var content = accessibilityController.focusedElement;
-
-          // get a marker that is invalid (the next one after the end of the body).
-          var textMarkerRange = content.textMarkerRangeForElement(content);
-          var endMarker = content.endTextMarkerForTextMarkerRange(textMarkerRange);
-
-          // Remove "content" so that the text marker becomes invalid.
-          document.getElementById("body").removeChild(document.getElementById("content"));
-
-          document.getElementById("body").focus();
-          var body = accessibilityController.focusedElement;
-
-          // Ask for the ui element for that marker (should not crash).
-          body.accessibilityElementForTextMarker(endMarker);
-    }
-
-</script>
-
-<script src="../../../fast/js/resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-indenting-list-item.html b/tests/tests/webkitsecurity/assets/crash-indenting-list-item.html
deleted file mode 100644
index 11ccad4..0000000
--- a/tests/tests/webkitsecurity/assets/crash-indenting-list-item.html
+++ /dev/null
@@ -1,8 +0,0 @@
-<div contentEditable><ul><li id='foo'></li></ul></div>
-<script src="../../resources/dump-as-markup.js"></script>
-<script>
-window.getSelection().setBaseAndExtent(foo, 0, foo, 0);
-// This test passes if it does not crash.
-document.execCommand('indent', false, null);
-document.getElementById("foo").innerText = "PASSED";
-</script>
diff --git a/tests/tests/webkitsecurity/assets/crash-inline-container-client.html b/tests/tests/webkitsecurity/assets/crash-inline-container-client.html
deleted file mode 100644
index ec9b9a0..0000000
--- a/tests/tests/webkitsecurity/assets/crash-inline-container-client.html
+++ /dev/null
@@ -1,24 +0,0 @@
-<svg>
-<g>
-<defs><linearGradient id="linearGradient"></linearGradient></defs>
-<text style="fill:url(#linearGradient);">
-  B<tspan>A</tspan>
-</text>
-<text style="filter:url(#dropShadow);">
-  <tspan id="tspan">K</tspan>
-</text>
-</g>
-
-<text x="10" y="30">This test passes if it does not crash.</text>
-
-<script>
-var canvas = document.createElement("canvas");
-document.getElementById("linearGradient").appendChild(canvas);
-range = document.createRange();
-range.setEndAfter(document.getElementById("tspan"));
-range.extractContents();
-
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
-</svg>
diff --git a/tests/tests/webkitsecurity/assets/crash-invalid-text-marker-node.html b/tests/tests/webkitsecurity/assets/crash-invalid-text-marker-node.html
deleted file mode 100644
index d6e2ca3..0000000
--- a/tests/tests/webkitsecurity/assets/crash-invalid-text-marker-node.html
+++ /dev/null
@@ -1,48 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../../fast/js/resources/js-test-pre.js"></script>
-</head>
-<body id="body">
-
-<iframe id="iframe" width=100 height=100></iframe>
-
-<p id="description"></p>
-<div id="console"></div>
-
-<script>
-
-    description("This protects against a crash when a text marker still holds a reference to a node that's been deallocated.");
-
-    // Add an element that a text marker can be retrieved from.
-    var contentDoc = document.getElementById("iframe").contentDocument; 
-    contentDoc.body.innerHTML = "<h1 tabindex='0'>content</h1>";
-
-    // Tab to the element. 
-    // Note: If the element has an "id" it won't get de-allocated in time, so .focus() can't be used.
-    eventSender.keyDown("\t");
-
-    // get a marker that will become invalid when the node disappears.
-    var axDiv = accessibilityController.focusedElement;
-    var textMarkerRange = axDiv.textMarkerRangeForElement(axDiv);
-    var invalidMarker = axDiv.startTextMarkerForTextMarkerRange(textMarkerRange);
-
-</script>
-
-<script>
-     // Write new content to cause all content to disappear.
-     contentDoc.body.innerHTML = "<h2>new content</h2>";
-</script>
-
-<script>
-    // Access the invalid marker (it should not crash).
-    document.getElementById("body").focus();
-    var body = accessibilityController.focusedElement;
-
-    body.accessibilityElementForTextMarker(invalidMarker);
-
-</script>
-
-<script src="../../../fast/js/resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-line-break-after-outdent.html b/tests/tests/webkitsecurity/assets/crash-line-break-after-outdent.html
deleted file mode 100644
index 22c4133..0000000
--- a/tests/tests/webkitsecurity/assets/crash-line-break-after-outdent.html
+++ /dev/null
@@ -1,29 +0,0 @@
-<head>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function f() {
-    document.designMode="on";
-    document.execCommand("SelectAll");
-    document.execCommand("InsertImage",false);
-    document.execCommand("InsertImage",false);
-    document.execCommand("Indent");
-    document.execCommand("insertunorderedlist",false);
-    document.execCommand("InsertUnorderedList",false);
-    document.execCommand("Bold");
-    document.execCommand("InsertLineBreak");
-    document.execCommand("insertunorderedlist");
-    document.execCommand("insertimage",false);
-    document.execCommand("insertparagraph",false);
-    document.execCommand("insertunorderedlist");
-    document.execCommand("InsertUnorderedList");
-    document.execCommand("Outdent");
-    document.write("<p>Test for bug <a href=\"https://bugs.webkit.org/show_bug.cgi?id=60778\">REGRESSION (83075): Crash in line break after outdent</p>");
-    document.write("<p>This test PASSED!</p>");
-}
- </script>
-</head>
-<body onload='f();'>
-    <pre id="x">x</pre>
-</body>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/crash-multiple-family-fontface.html b/tests/tests/webkitsecurity/assets/crash-multiple-family-fontface.html
deleted file mode 100644
index 7e53cd5..0000000
--- a/tests/tests/webkitsecurity/assets/crash-multiple-family-fontface.html
+++ /dev/null
@@ -1,23 +0,0 @@
-<html>
-<head>
-<style>
-    @font-face {
-        font-family:morris,xx;
-        /* Important: src cannot be local to trigger the crash */
-        src:url(doesNotExist.ttf);
-    }
-    body {
-        font:12px morris;
-    }
-
-</style>
-<script>
-    if (window.layoutTestController)
-        window.layoutTestController.dumpAsText();
-</script>
-</head>
-<body>
-    <p>Try to reference a custom font (@font-face) which was defined with more than 1 font-family.</p>
-    <p>PASS if does not crash</p>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-on-1px-border.html b/tests/tests/webkitsecurity/assets/crash-on-1px-border.html
deleted file mode 100644
index a63c049..0000000
--- a/tests/tests/webkitsecurity/assets/crash-on-1px-border.html
+++ /dev/null
@@ -1,15 +0,0 @@
-<head>
-<style>
-.thin {
-  border-bottom: 1px solid;
-  background: -webkit-gradient(linear, 0% 100%, 0% 100%, from(red), to(blue))
-}
-</style>
-<script>
-if (window.layoutTestController)
-  window.layoutTestController.dumpAsText();
-</script>
-</head>
-<body>
-<h1>Linear gradient with 1px border-bottom. Should not crash</h1>
-<div class="thin"></div>
diff --git a/tests/tests/webkitsecurity/assets/crash-on-absolute-positioning.html b/tests/tests/webkitsecurity/assets/crash-on-absolute-positioning.html
deleted file mode 100644
index ddde86a..0000000
--- a/tests/tests/webkitsecurity/assets/crash-on-absolute-positioning.html
+++ /dev/null
@@ -1,45 +0,0 @@
-<html>
-<script>
-if (window.layoutTestController)
-{
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-}
-
-function removeFloat()
-{
-    var float2 = document.getElementById('float2');
-    float2.style.display = 'none';
-    window.setTimeout('crash();', 0);
-}
-
-function crash()
-{
-    var block1 = document.getElementById('block1');
-    var float1 = document.getElementById('float1');
-    block1.style.position = 'absolute';
-    float1.style.display = 'none';
-    if (window.layoutTestController)
-    {
-        layoutTestController.notifyDone();
-    }
-}
-</script>
-<body onload="removeFloat()">
-<p>This test passes if it doesn't crash.</p>
-<div style="position:absolute; left:0; top:40">
-<div id="block1" style="border:solid">
-<div id="float1" style="float:left; width:50px; height:600px; background-color:purple; margin-left:5px"></div>
-<div id="float2" style="float:left; width:50px; height:150px; background-color:purple; margin-left:5px"></div>
-<div id="block2">A float is a renderer that is designed to shift all the way to the left side or all the way to the right side of a paragraph. The lines of the paragraph then flow around the floating object avoiding it. You can see an example of a float in this very paragraph. There is a purple box in the upper right hand corner. Note how all of the text in this paragraph is avoiding the float.</div>
-<div>A float is a renderer that is designed to shift all the way to the left side or all the way to the right side of a paragraph. The lines of the paragraph then flow around the floating object avoiding it. You can see an example of a float in this very paragraph. There is a purple box in the upper right hand corner. Note how all of the text in this paragraph is avoiding the float.</div>
-<div>A float is a renderer that is designed to shift all the way to the left side or all the way to the right side of a paragraph. The lines of the paragraph then flow around the floating object avoiding it. You can see an example of a float in this very paragraph. There is a purple box in the upper right hand corner. Note how all of the text in this paragraph is avoiding the float.</div>
-<div>A float is a renderer that is designed to shift all the way to the left side or all the way to the right side of a paragraph. The lines of the paragraph then flow around the floating object avoiding it. You can see an example of a float in this very paragraph. There is a purple box in the upper right hand corner. Note how all of the text in this paragraph is avoiding the float.</div>
-<div>A float is a renderer that is designed to shift all the way to the left side or all the way to the right side of a paragraph. The lines of the paragraph then flow around the floating object avoiding it. You can see an example of a float in this very paragraph. There is a purple box in the upper right hand corner. Note how all of the text in this paragraph is avoiding the float.</div>
-</div>
-<div>A float is a renderer that is designed to shift all the way to the left side or all the way to the right side of a paragraph. The lines of the paragraph then flow around the floating object avoiding it. You can see an example of a float in this very paragraph. There is a purple box in the upper right hand corner. Note how all of the text in this paragraph is avoiding the float.</div>
-<div>A float is a renderer that is designed to shift all the way to the left side or all the way to the right side of a paragraph. The lines of the paragraph then flow around the floating object avoiding it. You can see an example of a float in this very paragraph. There is a purple box in the upper right hand corner. Note how all of the text in this paragraph is avoiding the float.</div>
-<div>A float is a renderer that is designed to shift all the way to the left side or all the way to the right side of a paragraph. The lines of the paragraph then flow around the floating object avoiding it. You can see an example of a float in this very paragraph. There is a purple box in the upper right hand corner. Note how all of the text in this paragraph is avoiding the float.</div>
-</div>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-on-clear-selection-expected.png b/tests/tests/webkitsecurity/assets/crash-on-clear-selection-expected.png
deleted file mode 100644
index 59c5386..0000000
--- a/tests/tests/webkitsecurity/assets/crash-on-clear-selection-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/crash-on-clear-selection.html b/tests/tests/webkitsecurity/assets/crash-on-clear-selection.html
deleted file mode 100644
index 19fedae..0000000
--- a/tests/tests/webkitsecurity/assets/crash-on-clear-selection.html
+++ /dev/null
@@ -1,12 +0,0 @@
-If this doesn't crash, then the test passes.
-<div id=foo>foo</div>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    var foo = document.getElementById('foo');
-    window.getSelection().selectAllChildren(foo);
-
-    foo.style.display = 'none';
-    window.getSelection().removeAllRanges();
-</script>
diff --git a/tests/tests/webkitsecurity/assets/crash-on-custom-cursor-when-loading.html b/tests/tests/webkitsecurity/assets/crash-on-custom-cursor-when-loading.html
deleted file mode 100644
index bb16e58..0000000
--- a/tests/tests/webkitsecurity/assets/crash-on-custom-cursor-when-loading.html
+++ /dev/null
@@ -1,25 +0,0 @@
-<html>
-<head>
-<style>
-    div {
-        cursor: url(resources/purple-srgb.png);
-        width: 200;
-        height: 200;
-        background: green;
-    }
-</style>
-</head>
-<body>
-    <div></div>
-    <script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    if (window.eventSender) {
-        eventSender.dragMode = false;
-        eventSender.mouseMoveTo(50, 50)
-    }
-    </script>
-    <p>PASS without crash.</p>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-on-degenerate-gradient.html b/tests/tests/webkitsecurity/assets/crash-on-degenerate-gradient.html
deleted file mode 100644
index 82b2194..0000000
--- a/tests/tests/webkitsecurity/assets/crash-on-degenerate-gradient.html
+++ /dev/null
@@ -1,11 +0,0 @@
-<head>
-<script>
-if (window.layoutTestController)
-  window.layoutTestController.dumpAsText();
-</script>
-</head>
-<body>
-<h1>Degenerate Linear gradient. Should not crash</h1>
-<button style="background-image: -webkit-radial-gradient(1 1, Scrollbar -1, red -1)">
-</body>
-
diff --git a/tests/tests/webkitsecurity/assets/crash-on-drag-with-mutation-events-expected.png b/tests/tests/webkitsecurity/assets/crash-on-drag-with-mutation-events-expected.png
deleted file mode 100644
index 7de8711..0000000
--- a/tests/tests/webkitsecurity/assets/crash-on-drag-with-mutation-events-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/crash-on-drag-with-mutation-events.html b/tests/tests/webkitsecurity/assets/crash-on-drag-with-mutation-events.html
deleted file mode 100644
index e3c6277..0000000
--- a/tests/tests/webkitsecurity/assets/crash-on-drag-with-mutation-events.html
+++ /dev/null
@@ -1,47 +0,0 @@
-<body style="margin: 0px">
-<div>Make sure WebKit doesn't crash when web authors blast away everything in DOMNodeInserted handler! https://bugs.webkit.org/show_bug.cgi?id=22634</div>
-<div id="dragstart" contentEditable>Drag something from here to the document below</div>
-<iframe src="about:blank" id="iframe"></iframe>
-<script>
-var iframe = document.getElementById("iframe");
-iframe.style.height = "20px";
-var doc = iframe.contentDocument;
-doc.body.style.margin = "0px";
-var divForDrop = document.createElement("div");
-divForDrop.contentEditable = true;
-doc.body.appendChild(divForDrop);
-divForDrop.appendChild(document.createTextNode("Drop on this line!"));
-
-function clearDivDuringInsertion()
-{
-    doc.execCommand("selectall");
-    doc.execCommand("delete");
-    doc.execCommand("selectall");
-}
-
-divForDrop.addEventListener("DOMNodeInserted", clearDivDuringInsertion, true);
-
-if (window.eventSender) {
-    layoutTestController.dumpAsText();
-
-    var startDiv = document.getElementById("dragstart");
-    startDiv.focus();
-    document.execCommand("selectall");
-
-    var startX = startDiv.offsetLeft + 10;
-    var startY = startDiv.offsetTop + 10;
-
-    var endX = iframe.offsetLeft + divForDrop.offsetLeft + 10;
-    var endY = iframe.offsetTop + divForDrop.offsetTop + 10;
-
-    eventSender.mouseMoveTo(startX, startY);
-    eventSender.mouseDown();
-    eventSender.leapForward(1000);
-
-    eventSender.mouseMoveTo(endX, endY);
-    eventSender.mouseUp();
-    
-    document.body.innerHTML = "PASSED, no crash";
-}
-
-</script>
diff --git a/tests/tests/webkitsecurity/assets/crash-on-enter-in-contentEditable-list.html b/tests/tests/webkitsecurity/assets/crash-on-enter-in-contentEditable-list.html
deleted file mode 100644
index 5e21e70..0000000
--- a/tests/tests/webkitsecurity/assets/crash-on-enter-in-contentEditable-list.html
+++ /dev/null
@@ -1,9 +0,0 @@
-<script src="../../resources/dump-as-markup.js"></script>
-<div>This test passes if it doesn't crash.</div>
-<ul contentEditable>
-    <li id=foo></li>
-</ul>
-<script>
-window.getSelection().selectAllChildren(foo);
-document.execCommand('insertParagraph');
-</script>
diff --git a/tests/tests/webkitsecurity/assets/crash-on-mutate-during-drop.html b/tests/tests/webkitsecurity/assets/crash-on-mutate-during-drop.html
deleted file mode 100644
index 1b85004..0000000
--- a/tests/tests/webkitsecurity/assets/crash-on-mutate-during-drop.html
+++ /dev/null
@@ -1,41 +0,0 @@
-<html>
-<head>
-<script>
-function foo() {
-    if (event.type == "DOMNodeInserted" && event.target.nodeType == 3)
-        document.body.innerHTML = "PASSED";
-}
-
-function runTest() {
-    if (!window.layoutTestController)
-      return;
-
-    window.layoutTestController.dumpAsText();
-
-    document.addEventListener("DOMNodeInserted", function() { foo() }, true);
-
-    // Select the element 'dragSource'.
-    var selection = window.getSelection();
-    var range =  document.createRange();
-    range.selectNode(document.getElementById("dragSource"));
-    selection.addRange(range);
-
-    // Drag the source text to the target text.
-    var source = document.getElementById('dragSource');
-    var target = document.getElementById('dragTarget');
-    eventSender.mouseMoveTo(source.offsetLeft + 2, source.offsetTop + 2);
-    eventSender.mouseDown();
-    eventSender.leapForward(500);
-    eventSender.mouseMoveTo(target.offsetLeft + target.offsetWidth / 2,
-                            target.offsetTop + target.offsetHeight / 2);
-    eventSender.mouseUp();
-}
-</script>
-</head>
-<body contenteditable="true" onload="runTest()">
-<p>This test tests for a crash when a DOM mutation event listener
-   modifies the text during a drop. If the test doesn't crash, all is good.
-<p id="dragSource">drag source text
-<p id="dragTarget">drag dest text
-</body>
-</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/crash-on-remove.html b/tests/tests/webkitsecurity/assets/crash-on-remove.html
deleted file mode 100644
index 839c24c..0000000
--- a/tests/tests/webkitsecurity/assets/crash-on-remove.html
+++ /dev/null
@@ -1,16 +0,0 @@
-<p>
-    Test for <i><a href="https://bugs.webkit.org/show_bug.cgi?id=18879">https://bugs.webkit.org/show_bug.cgi?id=18879</a>
-    Reproducible crash when removing a gradient</i>.
-</p>
-<p>
-    The test should not crash and there should be a green square below.
-</p>
-<div id="target" style="width: 100px; height: 100px; background-color: green; background-image: -webkit-gradient(linear, left top, left bottom, from(red), to(transparent))">
-</div>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    document.body.offsetTop;
-    document.getElementById("target").style.removeProperty("background-image");
-</script>
diff --git a/tests/tests/webkitsecurity/assets/crash-on-tr.html b/tests/tests/webkitsecurity/assets/crash-on-tr.html
deleted file mode 100644
index 24b8cb0..0000000
--- a/tests/tests/webkitsecurity/assets/crash-on-tr.html
+++ /dev/null
@@ -1,21 +0,0 @@
-<head>
-<style type="text/css">
-.f {
-    background:-webkit-gradient(linear, left top, left bottom, from(#E7E7E7), to(#CFCFCF));
-}
-</style>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
-</head>
-
-This test should not crash (or ASSERT).<p>
-
-There should also be a table cell with a gradient below.<p>
-
-<table
-<tr class="f">
-<td>Gradient</td>
-</tr>
-</table>
diff --git a/tests/tests/webkitsecurity/assets/crash-on-zero-radius-expected.png b/tests/tests/webkitsecurity/assets/crash-on-zero-radius-expected.png
deleted file mode 100644
index fda6832..0000000
--- a/tests/tests/webkitsecurity/assets/crash-on-zero-radius-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/crash-on-zero-radius.html b/tests/tests/webkitsecurity/assets/crash-on-zero-radius.html
deleted file mode 100644
index 2b21eae..0000000
--- a/tests/tests/webkitsecurity/assets/crash-on-zero-radius.html
+++ /dev/null
@@ -1,10 +0,0 @@
-<head>
-<style>
-.radial { width:150px; height:150px; border:2px solid black;
-           background: -webkit-gradient(radial, 45 45, 0, 52 50, 0, from(#A7D30C), to(rgba(1,159,98,0)), color-stop(90%, #019F62)),
-                       -webkit-gradient(radial, 45 45, 10, 52 50, 30, from(#A7D30C), to(rgba(1,159,98,0)), color-stop(90%, #019F62)) }
-</style>
-</head>
-<body>
-<h1>Two gradients, one with zero radius that should not crash.</h1>
-<div class="radial"></div>
diff --git a/tests/tests/webkitsecurity/assets/crash-paint-no-documentElement-renderer.html-disabled b/tests/tests/webkitsecurity/assets/crash-paint-no-documentElement-renderer.html-disabled
deleted file mode 100755
index a4ea9e6..0000000
--- a/tests/tests/webkitsecurity/assets/crash-paint-no-documentElement-renderer.html-disabled
+++ /dev/null
@@ -1,20 +0,0 @@
-<!DOCTYPE html>
-<html>
-<body onload="go()">
-<p>Bug 64284: Crash in RenderBox::paintBoxDecorations when documentElement has no renderer</p>
-<p>For this test to PASS, it should not ASSERT or CRASH.</p>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    function go() {
-        document.open();
-        var oUElement = document.createElement("U");
-        oUElement.hidden=true;
-        oUElement.innerHTML="<style>*{-webkit-border-before-style:groove}";
-        document.appendChild(oUElement);
-        document.close();
-    }
-</script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-removed-iframe.html b/tests/tests/webkitsecurity/assets/crash-removed-iframe.html
deleted file mode 100644
index 49fdb44..0000000
--- a/tests/tests/webkitsecurity/assets/crash-removed-iframe.html
+++ /dev/null
@@ -1,52 +0,0 @@
-<html>
-<head>
-    <title>Crash doing open on destroyed window</title> 
-    <script> 
-    function testCrash1() {
-        var ifr = document.createElement('iframe');
-        ifr.onload = function() {
-            var win = ifr.contentWindow;
-            ifr.parentNode.removeChild(ifr);
-            win.open('pantz', '_top');
-        };
-        document.body.appendChild(ifr);
-    }
-
-    // Test with a deconnected iframe.
-    function testCrash2() {
-        var ifr = document.createElement('iframe');
-        ifr.onload = function() {
-            var win = ifr.contentWindow;
-            ifr.parentNode.removeChild(ifr);
-            win.open('pantz', ifr);
-        };
-        document.body.appendChild(ifr);
-    }
-
-    // Test with a new iframe.
-    function testCrash3() {
-        var ifr = document.createElement('iframe');
-        var ifr2 = document.createElement('iframe');
-        ifr.onload = function() {
-            var win = ifr.contentWindow;
-            ifr.parentNode.removeChild(ifr);
-            win.open('pantz', ifr2);
-        };
-        document.body.appendChild(ifr);
-    }
-
-    function testCrash() {
-        if (window.layoutTestController)
-            layoutTestController.dumpAsText();
-
-        testCrash1();
-        testCrash2();
-        testCrash3();
-    }
-    </script> 
-</head>
-<body onload="testCrash()">
-    <p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=19588">19588</a>: CRASH doing open() on destroyed window</p>
-    <p> If this page does not crash the test has passed. </p>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-reparent-tiled-layer.html b/tests/tests/webkitsecurity/assets/crash-reparent-tiled-layer.html
deleted file mode 100644
index d3d793e..0000000
--- a/tests/tests/webkitsecurity/assets/crash-reparent-tiled-layer.html
+++ /dev/null
@@ -1,63 +0,0 @@
-<!DOCTYPE html>
-<html>
-  <head>
-    <title>Test that switching to tiled layers when the parent is a tiled layer does not crash</title>
-
-    <style type="text/css" media="screen">
-
-    #container {
-      width: 500px;
-      height: 5000px;
-      border: 1px solid black;
-      background-color: yellow;
-      -webkit-transform:translateZ(0);
-    }
-    
-    #box {
-        position: absolute;
-        left:50px;
-        width: 200px;
-        height: 200px;
-        -webkit-transform:translateZ(0);
-        top: 100px;
-        background-color: red;
-    }
-    </style>
-    <script type="text/javascript" charset="utf-8">
-        if (window.layoutTestController) {
-            layoutTestController.dumpAsText();
-            layoutTestController.waitUntilDone();
-        }
-        
-        result = "";
-
-        function testOnLoad()
-        {
-            window.setTimeout(function() {
-                document.getElementById('box').style.height = "4800px";
-                
-                // Let it render
-                window.setTimeout(function() {
-                    if (window.layoutTestController) {
-                        document.getElementById('layers').innerHTML = layoutTestController.layerTreeAsText();
-                        layoutTestController.notifyDone();
-                    }
-                }, 0);
-            }, 0);
-        }
-      
-        window.addEventListener('load', testOnLoad, false);
-    </script>
-  </head>
-  <body>
-      <p>
-        From https://bugs.webkit.org/show_bug.cgi?id=44629. The parent is a tiled layer.
-        When the child is a non-tiled layer and it is switched to a tiled layer, a crash
-        occurs. This test should not crash.
-      </p>
-        <div id="container">
-          <div id="box"></div>
-        </div>
-        <pre id="layers">Layer tree appears here in DRT.</pre>
-  </body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-replaced-display-block.html b/tests/tests/webkitsecurity/assets/crash-replaced-display-block.html
deleted file mode 100644
index 56645f0..0000000
--- a/tests/tests/webkitsecurity/assets/crash-replaced-display-block.html
+++ /dev/null
@@ -1,11 +0,0 @@
-<p>This tests rdar://problem/6545095 ASSERTION FAILED: RenderBlock.h:519: !o || o->isRenderBlock()</p>
-
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-
-<div style="float: left; height: 1000px; width: 20px;"></div>
-<span>
-    <img style="display: block; width: auto;" />
-</span>
diff --git a/tests/tests/webkitsecurity/assets/crash-replacing-location-before-load.html b/tests/tests/webkitsecurity/assets/crash-replacing-location-before-load.html
deleted file mode 100644
index d37baea..0000000
--- a/tests/tests/webkitsecurity/assets/crash-replacing-location-before-load.html
+++ /dev/null
@@ -1,25 +0,0 @@
-<script>
-if (parent == window) {
-  if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-  }
-  function replaceHash(frag) {
-    frames[0].location.replace('#' + frag);
-  }
-  onload = function() {
-    var f = document.createElement("iframe");
-    f.src = location;
-    f.onload = function() {
-      delete f.onload;
-      replaceHash('bar');
-      if (window.layoutTestController)
-        layoutTestController.notifyDone();
-    }
-    document.body.appendChild(f);
-    replaceHash('foo');
-  }
-}
-</script>
-<!-- If we do not crash, then this test was successful. -->
-<body>PASS</body>
diff --git a/tests/tests/webkitsecurity/assets/crash-restoring-plugin-page-from-page-cache.html b/tests/tests/webkitsecurity/assets/crash-restoring-plugin-page-from-page-cache.html
deleted file mode 100644
index 4bc4b15..0000000
--- a/tests/tests/webkitsecurity/assets/crash-restoring-plugin-page-from-page-cache.html
+++ /dev/null
@@ -1,94 +0,0 @@
-<head>
-<script>
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-    layoutTestController.overridePreference("WebKitUsesPageCachePreferenceKey", 1);
-    layoutTestController.overridePreference("WebKitPageCacheSupportsPluginsPreferenceKey", 1);
-}
-
-function pageShown() {
-    if (event.persisted)
-        setTimeout("testComplete()", 0);   
-    else
-        setTimeout("startTest()", 0);
-}
-
-function testComplete() {
-    alert("Made it back!");
-    if (window.layoutTestController)
-        layoutTestController.notifyDone();
-}
-
-function startTest() {
-    document.getElementById("ExamplePlugin").setAttribute("style", "display:none");
-    window.location.href = 'resources/go-back.html';
-}
-
-</script>
-
-<style>
-    object { border-color: red; border-width: 2px; border-style:solid; }
-</style>
-</head>
-
-<body onpageshow="pageShown();">
-    
-This test - assuming it will pass - does the following:<br>
-1 - Has nested plugin elements<br>
-2 - Leaves the page, and the page enters the page cache<br>
-3 - Returns, pulling the page from the page cache<br>
-4 - Doesn't crash<br>
-<br>
-If you're not running under DRT, you'll need to leave the page then return to it yourself.
-<br>
-<object>
-<object>
-<object>
-<object>
-<object>
-<object>
-<object>
-<object>
-<object>
-<object>
-<object>
-<object>
-<object>
-<object>
-<object>
-<object>
-<object>
-<object>
-<object>
-<object>
-
-<object type="application/x-shockwave-flash" width="500" height="375" id="ExamplePlugin">
-    <img src="resources/apple.gif">
-</object>
-
-Some fallback text to force a renderer.
-
-</object>
-</object>
-</object>
-</object>
-</object>
-</object>
-</object>
-</object>
-</object>
-</object>
-</object>
-</object>
-</object>
-</object>
-</object>
-</object>
-</object>
-</object>
-</object>
-</object><br><br>
-
-(Yes, the extreme number of object elements are necessary to more reliably reproduce the crash.  Leave them.)
-</body>
diff --git a/tests/tests/webkitsecurity/assets/crash-section-logical-height-changed-needsCellRecalc.html b/tests/tests/webkitsecurity/assets/crash-section-logical-height-changed-needsCellRecalc.html
deleted file mode 100644
index facd6d5..0000000
--- a/tests/tests/webkitsecurity/assets/crash-section-logical-height-changed-needsCellRecalc.html
+++ /dev/null
@@ -1,53 +0,0 @@
-<style>
-.c3 { position: fixed; }
-.c12:first-letter { visibility: inherit; }
-.c12 { -webkit-appearance: button; }
-.c13 { display: table-row; }
-.c13:nth-last-child(odd) { height: 80%; }
-</style>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function boom() {
-    var quote = document.createElement('q');
-    document.documentElement.appendChild(quote);
-
-    base = document.createElement('base');
-    base2 = document.createElement('base');
-    base2.setAttribute('class', 'c3');
-    quote.appendChild(base2);
-
-    var ins = document.createElement('ins');
-    base2.appendChild(ins);
-
-    var sub = document.createElement('sub');
-    var quote3 = document.createElement('q');
-    quote3.setAttribute('class', 'c12');
-    sub.appendChild(quote3);
-
-    figureRow = document.createElement('figure');
-    figureRow.setAttribute('class', 'c13');
-    document.documentElement.appendChild(figureRow);
-
-    var col = document.createElement('col');
-    col.setAttribute('class', 'c13');
-    document.documentElement.appendChild(col);
-
-    var select = document.createElement('select');
-    document.documentElement.appendChild(select);
-
-    code = document.createElement('code');
-    document.documentElement.appendChild(code);
-
-    quote2 = document.createElement('q');
-    setTimeout('quote2.appendChild(code);', 321);
-    ins.appendChild(sub);
-    setTimeout('base.appendChild(figureRow);', 251);
-    text = document.createTextNode('-1435037881');
-    setTimeout('figureRow.appendChild(text);', 206);
-}
-window.onload = boom;
-</script>
-<p>Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=76842">76842</a>: Crash in WebCore::RenderTableSection::rowLogicalHeightChanged</p>
-<p>This test passes if it does not crash nor ASSERT.</p>
diff --git a/tests/tests/webkitsecurity/assets/crash-set-font.html b/tests/tests/webkitsecurity/assets/crash-set-font.html
deleted file mode 100644
index 108e281..0000000
--- a/tests/tests/webkitsecurity/assets/crash-set-font.html
+++ /dev/null
@@ -1,16 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-    <script>
-        if (window.layoutTestController)
-            layoutTestController.dumpAsText();
-
-        oContext2d = document.getCSSCanvasContext("2d","",0,0);
-        oContext2d.font = "small-caps .0ex G";
-        oContext2d.font = "italic .0ex G";
-        oContext2d.font = "italic 400 .0ex G";
-    </script>
-</head>
-<body>
-<p>Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=66291">66291</a>: Crash because CSSPrimitiveValue::computeLengthDouble assumes fontMetrics are available</p>
-<p>This test passed as it did not crash.</p>
diff --git a/tests/tests/webkitsecurity/assets/crash-splitColumn-2.html b/tests/tests/webkitsecurity/assets/crash-splitColumn-2.html
deleted file mode 100755
index 81f4573..0000000
--- a/tests/tests/webkitsecurity/assets/crash-splitColumn-2.html
+++ /dev/null
@@ -1,64 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<style>
-.c7 { display: table-row-group; }
-.c7:nth-last-of-type(-n+6) { float: none; }
-.c21:nth-child(2n) { position: static; float: left; }
-.c26 { border-style: ridge; content: counter(section);</style>
-<script>
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-}
-
-function crash()
-{
-    var img = document.createElement('img');
-    img.appendChild(select);
-    if (window.layoutTestController)
-        layoutTestController.notifyDone();
-}
-
-function insertNodes() {
-    document.documentElement.appendChild(document.createElement('a'));
-    document.documentElement.appendChild(document.createElement('dfn'));
-    document.documentElement.appendChild(document.createElement('keygen'));
-    var iframe = document.createElement('iframe');
-    iframe.setAttribute('src', 'dne.html');
-    document.documentElement.appendChild(iframe);
-    document.documentElement.appendChild(document.createElement('rp'));
-    document.documentElement.appendChild(document.createElement('ul'));
-    document.documentElement.appendChild(document.createElement('option'));
-    document.documentElement.appendChild(document.createElement('label'));
-    document.documentElement.appendChild(document.createElement('table'));
-    document.documentElement.appendChild(document.createElement('mark'));
-    document.documentElement.appendChild(document.createElement('bdo'));
-    document.documentElement.appendChild(document.createElement('colgroup'));
-    document.documentElement.appendChild(document.createElement('strong'));
-
-    select = document.createElement('select');
-    document.documentElement.appendChild(select);
-
-    var sup = document.createElement('sup');
-    sup.setAttribute('class', 'c7');
-    document.documentElement.appendChild(sup);
-    var td = document.createElement('td');
-    td.setAttribute('class', 'c21');
-    document.documentElement.appendChild(td);
-
-    var th = document.createElement('th');
-    th.setAttribute('colspan', '2');
-    th.setAttribute('class', 'c26');
-    sup.appendChild(th);
-
-    setTimeout(crash, 0);
-}
-window.addEventListener("load", insertNodes, false);
-</script>
-</head>
-<body>
-<p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=70171">70171</a>: Crash in RenderTableSection::splitColumn</p>
-<p> This test PASSES if it does not CRASH or ASSERT.</p>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-splitColumn-3.html b/tests/tests/webkitsecurity/assets/crash-splitColumn-3.html
deleted file mode 100644
index f431b12..0000000
--- a/tests/tests/webkitsecurity/assets/crash-splitColumn-3.html
+++ /dev/null
@@ -1,22 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function crash()
-{
-    var firstCell = document.getElementById("firstCell");
-    firstCell.parentNode.removeChild(firstCell);
-}
-
-window.addEventListener("load", crash, false);
-</script>
-</head>
-<body>
-<p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=70171">70171</a>: Crash in RenderTableSection::splitColumn</p>
-<p> This test PASSES if it does not CRASH or ASSERT.</p>
-<table><tr><td id="firstCell">foobar</td><td colspan="2"></td><td></td></tr></table>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-splitColumn.html b/tests/tests/webkitsecurity/assets/crash-splitColumn.html
deleted file mode 100755
index 43898b5..0000000
--- a/tests/tests/webkitsecurity/assets/crash-splitColumn.html
+++ /dev/null
@@ -1,38 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<style>
-.lastTableHeaderGroup:last-of-type { display: table-header-group; }</style>
-</style>
-<script>
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-}
-
-function crash()
-{
-    rubyTag.appendChild(lastTableHead);
-    if (window.layoutTestController)
-        layoutTestController.notifyDone();
-}
-
-function insertNodes() {
-    var tableHead = document.createElement('th');
-    tableHead.setAttribute('colspan', '5');
-    tableHead.setAttribute('class', 'lastTableHeaderGroup');
-    document.documentElement.appendChild(tableHead);
-    tableHead.appendChild(document.createElement('p'));
-    lastTableHead = document.createElement('th');
-    document.documentElement.appendChild(lastTableHead);
-    rubyTag = document.createElement('rt');
-    setTimeout(crash, 0);
-}
-window.addEventListener("load", insertNodes, false);
-</script>
-</head>
-<body>
-<p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=70171">70171</a>: Crash in RenderTableSection::splitColumn</p>
-<p> This test PASSES if it does not CRASH or ASSERT.</p>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-style-first-letter.html b/tests/tests/webkitsecurity/assets/crash-style-first-letter.html
deleted file mode 100644
index fde9860..0000000
--- a/tests/tests/webkitsecurity/assets/crash-style-first-letter.html
+++ /dev/null
@@ -1 +0,0 @@
-<svg><p>Test for https://bugs.webkit.org/show_bug.cgi?id=49316: The test PASSED if it did not crash.</p><script>if (window.layoutTestController) layoutTestController.dumpAsText();</script><use><style>:first-letter{margin-right:auto}<i><style>
diff --git a/tests/tests/webkitsecurity/assets/crash-svg-document.html b/tests/tests/webkitsecurity/assets/crash-svg-document.html
deleted file mode 100644
index fe7ac42..0000000
--- a/tests/tests/webkitsecurity/assets/crash-svg-document.html
+++ /dev/null
@@ -1,12 +0,0 @@
-<body>
-<script>
-
-if (window.layoutTestController) {
-    layoutTestController.setFrameFlatteningEnabled(true);
-    layoutTestController.dumpAsText();
-}
-
-</script>
-<iframe src="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg'></svg>"></iframe>
-Should not crash.
-</body>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/crash-table-cell-change-height.html b/tests/tests/webkitsecurity/assets/crash-table-cell-change-height.html
deleted file mode 100755
index ba308d0..0000000
--- a/tests/tests/webkitsecurity/assets/crash-table-cell-change-height.html
+++ /dev/null
@@ -1,22 +0,0 @@
-<!DOCTYPE html>
-<html>
-<body>
-<table>
-<tr id="row">
-<th id="header" height="50">If this test does not crash, it has PASSED.</th>
-<th>Bug 72004: Crash in styleDidChange when changing a table cell's height.<br></th>
-</tr>
-</table>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-var row = document.getElementById("row");
-var header = document.getElementById("header");
-row.parentNode.appendChild(header);
-</script>
-<script>
-header.setAttribute("height", 1);
-</script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-text-in-textpath.svg b/tests/tests/webkitsecurity/assets/crash-text-in-textpath.svg
deleted file mode 100755
index 4fc2841..0000000
--- a/tests/tests/webkitsecurity/assets/crash-text-in-textpath.svg
+++ /dev/null
@@ -1,20 +0,0 @@
-<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
-<text>
-    <textPath id="textPath">
-        <script>
-            if (window.layoutTestController)
-                layoutTestController.dumpAsText();
-
-            // This triggers a layout before adding the #text node.
-            document.getElementById('textPath').scrollIntoView('foo');
-        </script>
-        foo    
-        <script>
-            // This triggers a layout after adding the #text node to fire the ASSERT.
-            document.getElementById('textPath').scrollIntoView('foo');
-        </script>
-    </textPath>
-</text>
-<text x="10" y="50">Test for bug <a xlink:href="https://bugs.webkit.org/show_bug.cgi?id=63076">63076</a>: Assertion failure in RenderSVGInlineText::characterStartsNewTextChunk</text>
-<text x="10" y="100">This test passes if it does not crash</text>
-</svg>
diff --git a/tests/tests/webkitsecurity/assets/crash-textPath-attributes-iframe.svg b/tests/tests/webkitsecurity/assets/crash-textPath-attributes-iframe.svg
deleted file mode 100755
index bdad494..0000000
--- a/tests/tests/webkitsecurity/assets/crash-textPath-attributes-iframe.svg
+++ /dev/null
@@ -1,3 +0,0 @@
-<!DOCTYPE svg>
-<?xml-stylesheet href="data:text/css,:before{content:counter(x)}"?>
-<svg xmlns="http://www.w3.org/2000/svg"><text>x<tspan>  <tspan
diff --git a/tests/tests/webkitsecurity/assets/crash-textPath-attributes.html b/tests/tests/webkitsecurity/assets/crash-textPath-attributes.html
deleted file mode 100755
index 0ba1be5..0000000
--- a/tests/tests/webkitsecurity/assets/crash-textPath-attributes.html
+++ /dev/null
@@ -1,13 +0,0 @@
-<iframe src="resources/crash-textPath-attributes-iframe.svg" onload="go(this)"></iframe>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    function go(oIframe) {
-      var oSelection = oIframe.contentWindow.getSelection();
-      oSelection.selectAllChildren(oIframe.contentDocument);
-      oSelection.deleteFromDocument();
-    }
-</script>
-<p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=62439">Update SVG position values on SVG DOM updates</a></p>
-<p>This test PASSES if he does not crash</p>
diff --git a/tests/tests/webkitsecurity/assets/crash-when-navigating-away-then-back.html b/tests/tests/webkitsecurity/assets/crash-when-navigating-away-then-back.html
deleted file mode 100644
index 28bbeb3..0000000
--- a/tests/tests/webkitsecurity/assets/crash-when-navigating-away-then-back.html
+++ /dev/null
@@ -1,22 +0,0 @@
-<html manifest="crash-when-navigating-away-then-back.manifest">
-<script>
-
-function cached()
-{
-    window.close();
-    window.opener.closedWindow();
-}
-
-function noupdate()
-{
-    window.opener.document.getElementById('result').innerHTML = 'SUCCESS';
-    window.close();
-    if (window.layoutTestController)
-        layoutTestController.notifyDone();
-}
-
-applicationCache.addEventListener('cached', cached, false);
-applicationCache.addEventListener('noupdate', noupdate, false);
-
-</script>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-when-navigating-away-then-back.manifest b/tests/tests/webkitsecurity/assets/crash-when-navigating-away-then-back.manifest
deleted file mode 100644
index a9fb276..0000000
--- a/tests/tests/webkitsecurity/assets/crash-when-navigating-away-then-back.manifest
+++ /dev/null
@@ -1,2 +0,0 @@
-CACHE MANIFEST
-crash-when-navigating-away-then-back.html
diff --git a/tests/tests/webkitsecurity/assets/crash-when-reparent-sibling.html b/tests/tests/webkitsecurity/assets/crash-when-reparent-sibling.html
deleted file mode 100644
index 973b12e..0000000
--- a/tests/tests/webkitsecurity/assets/crash-when-reparent-sibling.html
+++ /dev/null
@@ -1,45 +0,0 @@
-<html>
-    <head>
-        <script>
-        function runTest()
-        {
-            if (window.layoutTestController)
-                layoutTestController.dumpAsText();
-
-            // Create a run-in.
-            var elem = document.createElement("div");
-            elem.id = "run-in";
-            elem.innerHTML = "run-in";
-            elem.setAttribute("style", "display: run-in");
-            document.body.appendChild(elem);
-
-            // Create a sibling block to the run-in.
-            elem = document.createElement("div");
-            elem.id = "block-sibling";
-            elem.innerHTML = "block sibling";
-            document.body.appendChild(elem);
-
-            // Trigger a re-paint.
-            document.body.offsetTop;
-
-            // Add a block child to the run-in.
-            elem = document.createElement("div");
-            elem.innerHTML = "block child";
-            elem.setAttribute("style", "display: table");
-            document.getElementById("run-in").appendChild(elem);
-            
-            // Trigger a re-paint.
-            document.body.offsetTop;
-
-            // Reparent the run-in's sibling block.
-            document.getElementById("output").appendChild(document.getElementById("block-sibling"));
-            document.getElementById("result").innerHTML = "PASS";
-        }    
-        </script>
-    </head>
-    <body onload="runTest()">
-        <div id="result"></div>
-        Output: <br/>
-        <div id="output"></div>
-    </body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-while-loading-tag-with-pause.html b/tests/tests/webkitsecurity/assets/crash-while-loading-tag-with-pause.html
deleted file mode 100644
index 88db4ab..0000000
--- a/tests/tests/webkitsecurity/assets/crash-while-loading-tag-with-pause.html
+++ /dev/null
@@ -1,8 +0,0 @@
-<script>
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.setXSSAuditorEnabled(true);
-}
-</script>
-This test passes if it doesn't crash.<br>
-<iframe src="resources/tag-with-pause.php?onclick=alert(1)"></iframe>
diff --git a/tests/tests/webkitsecurity/assets/crash-with-noelement-selectbox.html b/tests/tests/webkitsecurity/assets/crash-with-noelement-selectbox.html
deleted file mode 100644
index a880531..0000000
--- a/tests/tests/webkitsecurity/assets/crash-with-noelement-selectbox.html
+++ /dev/null
@@ -1,29 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../fast/js/resources/js-test-pre.js"></script>
-</head>
-<body id="body">
-
-<select id="selectBox">
-</select>
-<p id="description"></p>
-<div id="console"></div>
-
-<script>
-
-    description("This tests that there's no crash when accessising the stringValue of a menu list that has no elements.");
-
-    if (window.accessibilityController) {
-       document.getElementById("selectBox").focus();
-       var selectBox = accessibilityController.focusedElement;
-
-       // this call should not crash. 
-       var stringValue = selectBox.stringValue;
-    }
-
-</script>
-
-<script src="../fast/js/resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/crashing-a-tag-in-map.html b/tests/tests/webkitsecurity/assets/crashing-a-tag-in-map.html
deleted file mode 100644
index 74460e1..0000000
--- a/tests/tests/webkitsecurity/assets/crashing-a-tag-in-map.html
+++ /dev/null
@@ -1,38 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../fast/js/resources/js-test-pre.js"></script>
-</head>
-<body id="body">
-
-<div class="body">
-
-<img src="resources/cake.png" height="500" width="613" border="0" usemap="#img">
-<map id="img" name="img">
-<area shape="rect" coords="97,45,5,5" href="test.html" alt="">
-<area shape="rect" coords="447,45,5,5" href="test.html">
-<a href="test.html"></a>
-<area shape="default" nohref="nohref" alt="">
-</map></div>
-
-<p id="description"></p>
-<div id="console"></div>
-
-<script>
-
-    description("This tests that a hit test on a image map that has areas and anchors does not crash");
-
-    if (window.accessibilityController) {
-
-          var body = document.getElementById("body");
-          body.focus();
-
-          // test fails if it crashes here
-          var control = accessibilityController.focusedElement.elementAtPoint(100, 100);
-    }
-
-</script>
-
-<script src="../fast/js/resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/create-blob-url-crash.html b/tests/tests/webkitsecurity/assets/create-blob-url-crash.html
deleted file mode 100644
index 8001244..0000000
--- a/tests/tests/webkitsecurity/assets/create-blob-url-crash.html
+++ /dev/null
@@ -1,31 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<script>
-function log(message)
-{
-    document.getElementById('console').appendChild(document.createTextNode(message + "\n"));
-}
-
-function test()
-{
-    log("Test that createObjectURL with no argument should throw an exception.");
-    try {
-        var url = webkitURL.createObjectURL();
-        log("FAIL");
-    } catch(err) {
-        log("PASS: " + err.message);
-    }
-
-    log("DONE");
-}
-
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
-</head>
-<body onload="test()">
-<pre id='console'></pre>
-</body>
-</html>
-
diff --git a/tests/tests/webkitsecurity/assets/create-document-crash-on-attach-event.html b/tests/tests/webkitsecurity/assets/create-document-crash-on-attach-event.html
deleted file mode 100644
index 72250c9..0000000
--- a/tests/tests/webkitsecurity/assets/create-document-crash-on-attach-event.html
+++ /dev/null
@@ -1,10 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../js/resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="script-tests/create-document-crash-on-attach-event.js"></script>
-<script src="../js/resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/create-document-crash-on-attach-event.js b/tests/tests/webkitsecurity/assets/create-document-crash-on-attach-event.js
deleted file mode 100644
index aa5f6a1..0000000
--- a/tests/tests/webkitsecurity/assets/create-document-crash-on-attach-event.js
+++ /dev/null
@@ -1,6 +0,0 @@
-description('This test checks for crashes in setting an event handler on a document element created by '
-            + 'document.implementation.createDocument.');
-
-var doc = document.implementation.createDocument('', '', null);
-doc.onload = function() { };
-testPassed('Attached onload event handler to created document.');
diff --git a/tests/tests/webkitsecurity/assets/create-pattern-does-not-crash.html b/tests/tests/webkitsecurity/assets/create-pattern-does-not-crash.html
deleted file mode 100644
index e2db81d..0000000
--- a/tests/tests/webkitsecurity/assets/create-pattern-does-not-crash.html
+++ /dev/null
@@ -1,13 +0,0 @@
-<!DOCTYPE HTML>
-<canvas id="c"></canvas><br/>
-This test case ensures we don't crash when using canvas.createPattern
-<script>
-window.onload = function ()
-{
-    if (window.layoutTestController)
-        window.layoutTestController.dumpAsText();
-    var canvas = document.getElementById('c');
-    var ctx = canvas.getContext('2d');
-    var p = ctx.createPattern(canvas, 'no-repeat');
-}
-</script>
diff --git a/tests/tests/webkitsecurity/assets/cross-origin-stylesheet-crash-expected.png b/tests/tests/webkitsecurity/assets/cross-origin-stylesheet-crash-expected.png
deleted file mode 100644
index 3b9792c..0000000
--- a/tests/tests/webkitsecurity/assets/cross-origin-stylesheet-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/cross-origin-stylesheet-crash-expected.webarchive b/tests/tests/webkitsecurity/assets/cross-origin-stylesheet-crash-expected.webarchive
deleted file mode 100644
index 8828aa8..0000000
--- a/tests/tests/webkitsecurity/assets/cross-origin-stylesheet-crash-expected.webarchive
+++ /dev/null
@@ -1,71 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>WebMainResource</key>
-	<dict>
-		<key>WebResourceData</key>
-		<string>&lt;html&gt;&lt;head&gt;
-&lt;script&gt;
-if (window.layoutTestController)
-    layoutTestController.dumpDOMAsWebArchive();
-&lt;/script&gt;
-&lt;link rel="stylesheet" href="http://localhost:8000/webarchive/resources/localhost-stylesheet.css" type="text/css"&gt;
-&lt;/head&gt;
-&lt;body&gt;
-This HTML links to an external stylesheet from a different security origin.&lt;br&gt;
-Making a webarchive of this page should not crash.
-
-
-&lt;/body&gt;&lt;/html&gt;</string>
-		<key>WebResourceFrameName</key>
-		<string></string>
-		<key>WebResourceMIMEType</key>
-		<string>text/html</string>
-		<key>WebResourceTextEncodingName</key>
-		<string>UTF-8</string>
-		<key>WebResourceURL</key>
-		<string>http://127.0.0.1:8000/webarchive/cross-origin-stylesheet-crash.html</string>
-	</dict>
-	<key>WebSubresources</key>
-	<array>
-		<dict>
-			<key>WebResourceData</key>
-			<string>
-</string>
-			<key>WebResourceMIMEType</key>
-			<string>text/css</string>
-			<key>WebResourceResponse</key>
-			<dict>
-				<key>MIMEType</key>
-				<string>text/css</string>
-				<key>URL</key>
-				<string>http://localhost:8000/webarchive/resources/localhost-stylesheet.css</string>
-				<key>allHeaderFields</key>
-				<dict>
-					<key>Accept-Ranges</key>
-					<string>bytes</string>
-					<key>Content-Length</key>
-					<string>1</string>
-					<key>Content-Type</key>
-					<string>text/css</string>
-					<key>Date</key>
-					<string>Sun, 16 Nov 2008 17:00:00 GMT</string>
-					<key>Etag</key>
-					<string>"301925-21-45c7d72d3e780"</string>
-					<key>Last-Modified</key>
-					<string>Sun, 16 Nov 2008 16:55:00 GMT</string>
-					<key>Server</key>
-					<string>Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.7l PHP/5.2.6</string>
-				</dict>
-				<key>expectedContentLength</key>
-				<integer>1</integer>
-				<key>statusCode</key>
-				<integer>200</integer>
-			</dict>
-			<key>WebResourceURL</key>
-			<string>http://localhost:8000/webarchive/resources/localhost-stylesheet.css</string>
-		</dict>
-	</array>
-</dict>
-</plist>
diff --git a/tests/tests/webkitsecurity/assets/cross-origin-stylesheet-crash.html b/tests/tests/webkitsecurity/assets/cross-origin-stylesheet-crash.html
deleted file mode 100644
index 82a18e3..0000000
--- a/tests/tests/webkitsecurity/assets/cross-origin-stylesheet-crash.html
+++ /dev/null
@@ -1,13 +0,0 @@
-<html>
-<head>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpDOMAsWebArchive();
-</script>
-<link rel="stylesheet" href="http://localhost:8000/webarchive/resources/localhost-stylesheet.css" type="text/css">
-</head>
-<body>
-This HTML links to an external stylesheet from a different security origin.<br>
-Making a webarchive of this page should not crash.
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/css-content-and-webkit-mask-box-image-crash.html b/tests/tests/webkitsecurity/assets/css-content-and-webkit-mask-box-image-crash.html
deleted file mode 100644
index 4f12718..0000000
--- a/tests/tests/webkitsecurity/assets/css-content-and-webkit-mask-box-image-crash.html
+++ /dev/null
@@ -1,15 +0,0 @@
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    function insertSpan() {
-        document.getElementById("container").innerHTML = "<span style=\"content:url('resources/compass.jpg'); -webkit-mask-box-image:url('resources/compass.jpg');\">FAIL</span>";
-    }
-</script>
-<body onload="insertSpan()">
-    The test passes if you see the Safari icon below.
-    <div id="container"></div>
-    <script>
-        insertSpan();
-    </script>
-</body>
diff --git a/tests/tests/webkitsecurity/assets/css-fontface-rule-crash.html b/tests/tests/webkitsecurity/assets/css-fontface-rule-crash.html
deleted file mode 100644
index 0e7fb84..0000000
--- a/tests/tests/webkitsecurity/assets/css-fontface-rule-crash.html
+++ /dev/null
@@ -1,37 +0,0 @@
-<html>
-<head>
-<script src="../../resources/gc.js"></script>
-<script>
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-}
-
-function load()
-{
-    style = document.createElement('style');
-    style.textContent = '@font-face { font-family: "A"; }';
-    document.head.appendChild(style);
-    rulestyle = document.styleSheets[0].cssRules[0].style;
-    document.head.removeChild(style);
-    style = null;
-    setTimeout(crash, 0);
-}
-
-function crash()
-{
-    gc();
-    obj = rulestyle.parentRule;
-    // If the gc() actually successfully reaps everything it can, then obj
-    // will end up null (post-fix). gc() is not guaranteed to reap the font-face
-    // rule, however, particularly in the browser context.
-    if (obj)
-        obj = obj.foo;
-    document.body.innerText = 'PASS';
-    if (window.layoutTestController)
-        layoutTestController.notifyDone()
-}
-</script>
-</head>
-<body onload="load()"></body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/css-inline-style-declaration-crash.html b/tests/tests/webkitsecurity/assets/css-inline-style-declaration-crash.html
deleted file mode 100644
index 0bf6c0c..0000000
--- a/tests/tests/webkitsecurity/assets/css-inline-style-declaration-crash.html
+++ /dev/null
@@ -1,14 +0,0 @@
-<!DOCTYPE html>
-<script src="../js/resources/js-test-pre.js"></script>
-<script>
-description('Setting a CSSStyleDeclaration after its element has been GCed should not crash.');
-
-var span = document.createElement('span');
-var style = span.style;
-span = null;
-gc();
-style.cssText = 'color:red';
-
-testPassed('Did not crash');
-</script>
-<script src="../js/resources/js-test-post.js"></script>
diff --git a/tests/tests/webkitsecurity/assets/css-keyframe-style-crash.html b/tests/tests/webkitsecurity/assets/css-keyframe-style-crash.html
deleted file mode 100644
index 713043f..0000000
--- a/tests/tests/webkitsecurity/assets/css-keyframe-style-crash.html
+++ /dev/null
@@ -1,40 +0,0 @@
-<html>
-<head>
-<script>
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-}
-
-if (!window.gc)
-{
-    window.gc = function()
-    {
-        if (window.GCController)
-            return GCController.collect();
-        for (var i = 0; i < 10000; i++)
-            var s = new String("abc");
-    }
-}
-
-function load()
-{
-    style = document.createElement('style');
-    style.textContent = '@-webkit-keyframes anim { from { color: green } }';
-    document.head.appendChild(style);
-    rule = document.styleSheets[0].cssRules[0].findRule('from');
-    document.head.removeChild(style);
-    setTimeout(crash, 0);
-}
-
-function crash()
-{
-    gc();
-    obj = rule.style.parentRule;
-    if (window.layoutTestController)
-        layoutTestController.notifyDone()
-}
-</script>
-</head>
-<body onload="load()">PASS</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/css3-radial-gradient-crash.html b/tests/tests/webkitsecurity/assets/css3-radial-gradient-crash.html
deleted file mode 100644
index be9ad58..0000000
--- a/tests/tests/webkitsecurity/assets/css3-radial-gradient-crash.html
+++ /dev/null
@@ -1,11 +0,0 @@
-<head>
-<script>
-if (window.layoutTestController)
-  window.layoutTestController.dumpAsText();
-</script>
-</head>
-<body>
-<p>This test should not crash.</p>
-<div style="height: 10px; width: 10px; background-image: -webkit-radial-gradient(top)"></div>
-</body>
-
diff --git a/tests/tests/webkitsecurity/assets/cssTarget-crash.html b/tests/tests/webkitsecurity/assets/cssTarget-crash.html
deleted file mode 100644
index db5669c..0000000
--- a/tests/tests/webkitsecurity/assets/cssTarget-crash.html
+++ /dev/null
@@ -1,30 +0,0 @@
-<html>
-<body>
-<div><a href="rdar://4504805&4577323&4643028&5659812">Should not crash.</a></div>
-<form name="f" method="GET" action="#a"></form>
-<div id="anchors"><a name="a"></a></div>
-<script>
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-}
-
-var stopped = false;
-setTimeout("doIt()", 0);
-setTimeout("stopped = true;", 100);
-function doIt() {
-    if (stopped) {
-        if (window.layoutTestController)
-            layoutTestController.notifyDone();
-        return;
-    }
-    document.forms.f.submit();
-    var x=Math.random();
-    setTimeout("doIt("+x+")",10);
-    document.forms.f.action="#"+x;
-    document.getElementById("anchors").innerHTML+=
-        "<img width=100 height=100><a name=\""+x+"\"></a>";
-}
-</script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/custom-font-data-crash.html b/tests/tests/webkitsecurity/assets/custom-font-data-crash.html
deleted file mode 100644
index 1ea1eeb..0000000
--- a/tests/tests/webkitsecurity/assets/custom-font-data-crash.html
+++ /dev/null
@@ -1,18 +0,0 @@
-<!DOCTYPE html>
-<html>
-<body style="font: 1px ahem;">
-<script>
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-}
-
-setTimeout("if (window.layoutTestController) { layoutTestController.notifyDone(); }", 50);
-</script>
-<style>
-@font-face { font-family: "A"; src: url(); }
-* { font-family: A; }
-</style>
-<nobr><table><hr>PASS
-</body>
-</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/custom-font-data-crash2.html b/tests/tests/webkitsecurity/assets/custom-font-data-crash2.html
deleted file mode 100644
index bf1eb51..0000000
--- a/tests/tests/webkitsecurity/assets/custom-font-data-crash2.html
+++ /dev/null
@@ -1,33 +0,0 @@
-<!DOCTYPE html>
-<html>
-<style>
-@font-face { font-family: A; src: url(); }
-#y { font-family: A; }
-#y:first-letter { content: "A"; }
-</style>
-<body>
-<div id="y">EFGH</div>
-</body>
-<script>
-function finish() {
-    document.body.innerHTML = "PASS";
-	if (window.layoutTestController)
-	    layoutTestController.notifyDone();
-}
-
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-}
-
-document.designMode = 'on';
-document.execCommand('selectall');
-
-// Let the font load to finish.
-setTimeout("finish()", 50);
-</script>
-<style>
-#y:before { content: "ABCD"; }
-</style>
-</body>
-</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/dangling-form-element-crash.html b/tests/tests/webkitsecurity/assets/dangling-form-element-crash.html
deleted file mode 100644
index f5d097e..0000000
--- a/tests/tests/webkitsecurity/assets/dangling-form-element-crash.html
+++ /dev/null
@@ -1,36 +0,0 @@
-<html>
-  <script>
-    if (window.layoutTestController) {
-        layoutTestController.dumpAsText();
-        layoutTestController.waitUntilDone();
-    }
-
-    function gc() {
-        if (window.GCController)
-            return GCController.collect();
-        for (var i = 0; i < 10000; ++i)
-            var s = new String("foo");
-    }
-
-    function resetFormOwner() {
-        gc();
-        var form = document.createElement('form');
-        form.id = 'foo';
-        document.body.appendChild(form);
-        document.body.innerHTML += 'PASS';
-        if (window.layoutTestController)
-            layoutTestController.notifyDone();
-    }
-
-    function test() {
-        var div = document.createElement('div');
-        var input = document.createElement('input');
-        input.setAttribute('form', 'foo');
-        div.appendChild(input);
-        setTimeout(resetFormOwner, 0);
-    }
-  </script>
-<body onload="test()">
-<p>Checks dangling form associated elements doesn't cause crash. WebKit should not crash when this page is loaded.</p>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/dashboard-regions-attr-crash-expected.png b/tests/tests/webkitsecurity/assets/dashboard-regions-attr-crash-expected.png
deleted file mode 100644
index b91766d..0000000
--- a/tests/tests/webkitsecurity/assets/dashboard-regions-attr-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/dashboard-regions-attr-crash.html b/tests/tests/webkitsecurity/assets/dashboard-regions-attr-crash.html
deleted file mode 100644
index 5553ed3..0000000
--- a/tests/tests/webkitsecurity/assets/dashboard-regions-attr-crash.html
+++ /dev/null
@@ -1,14 +0,0 @@
-<html>
-<head>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-</head>
-<body>
-<p>Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=8469">http://bugs.webkit.org/show_bug.cgi?id=8469</a> CRASH: WebCore::CSSParser::parseDashboardRegions when attr() is passed</i>.</p>
-<p>If the test passes it won't crash</p> 
-<br style="-webkit-dashboard-region: dashboard-region("a");">
-<table style="-webkit-dashboard-region: attr("a");">
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/data-view-crash.html b/tests/tests/webkitsecurity/assets/data-view-crash.html
deleted file mode 100644
index 6fce7bc..0000000
--- a/tests/tests/webkitsecurity/assets/data-view-crash.html
+++ /dev/null
@@ -1,21 +0,0 @@
-<html>
-<head>
-<script src="../../js/resources/js-test-pre.js"></script>
-</head>
-<body>
-<div id="description"></div>
-<div id="console"></div>
-
-<script>
-description("Test that DataView does not crash with bad offset or length.");
-
-var array = new Uint8Array([164, 112, 157, 63]);
-var view;
-shouldThrow("view = new DataView(array.buffer, -4500000000)");
-shouldThrow("view = new DataView(array.buffer, -4500000000, 4500000000)");
-var value = view ? view.getFloat32(0, true) : 0;
-</script>
-
-<script src="../../js/resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/debugger-activation-crash.html b/tests/tests/webkitsecurity/assets/debugger-activation-crash.html
deleted file mode 100644
index b405770..0000000
--- a/tests/tests/webkitsecurity/assets/debugger-activation-crash.html
+++ /dev/null
@@ -1,42 +0,0 @@
-<script src="../../http/tests/inspector/inspector-test.js"></script>
-<script src="../../http/tests/inspector/debugger-test.js"></script>
-
-<script>
-var closures = [];
-function makeClosure() {
-    var v1, v2, v3, v4, v5, v6, v7, v8, v9, v10; // Make a lot of potentially captured variables.
-    return function (){ return v1; }; // But only capture one in optimizing compiles.
-}
-
-for (var i = 0; i < 100; ++i) {
-    closures.push(makeClosure());
-}
-
-function tryCrash() {
-    makeClosure(); // Force recompilation.
-    
-    // At this point, we should have 100 activations that captured 1 variable
-    // but think they captured 10. If so, GC should make them crash.
-    if (window.GCController)
-        GCController.collect();
-    else {
-        for (var i = 0; i < 10000; ++i)
-            new Object;
-    }
-}
-
-function test() {
-    InspectorTest.startDebuggerTest(function () {
-        InspectorTest.evaluateInPage("tryCrash()");
-        InspectorTest.completeDebuggerTest();
-    });
-}
-
-window.onload = runTest;
-</script>
-
-<p>
-Tests for a crash caused by inaccurate Activation records.
-&lt;rdar://problem/8525907&gt; Crash in debugger beneath MarkStack::drain @ me.com, ibm.com
-</p>
-
diff --git a/tests/tests/webkitsecurity/assets/debugger-activation-crash2.html b/tests/tests/webkitsecurity/assets/debugger-activation-crash2.html
deleted file mode 100644
index b1a718a..0000000
--- a/tests/tests/webkitsecurity/assets/debugger-activation-crash2.html
+++ /dev/null
@@ -1,54 +0,0 @@
-<script src="../../http/tests/inspector/inspector-test.js"></script>
-<script src="../../http/tests/inspector/debugger-test.js"></script>
-
-<script>
-var closures = [];
-function makeClosure() {
-    var v1, v2, v3, v4, v5, v6, v7, v8, v9, v10; // Make a lot of potentially captured variables.
-    return function () { 
-        var x = v1; // But only capture one in optimizing compiles.
-        return x;
-    };
-}
-
-for (var i = 0; i < 100; ++i) {
-    closures.push(makeClosure());
-}
-
-closures[0](); // Force compilation.
-function testFunction() {
-    closures[0](); // Force recompilation.
-    
-    // At this point, closures[0] captured 1 variable but thinks it captured 10.
-    // If so, stopping at a breakpoint should make it crash.
-}
-
-function test() {
-    InspectorTest.startDebuggerTest(step1);
-
-    function step1()
-    {
-        InspectorTest.showScriptSource("debugger-activation-crash2.html", step2);
-    }
-
-    function step2(sourceFrame)
-    {
-        InspectorTest.addResult("Script source was shown.");
-        InspectorTest.setBreakpoint(sourceFrame, 8, "", true);
-        InspectorTest.runTestFunctionAndWaitUntilPaused(step3);
-    }
-
-    function step3(callFrames)
-    {
-        InspectorTest.captureStackTrace(callFrames, true);
-        InspectorTest.completeDebuggerTest();
-    }
-}
-
-window.onload = runTest;
-</script>
-
-<p>
-Tests for a crash when paused at a breakpoint caused by inaccurate Activation records.
-<a href="https://bugs.webkit.org/show_bug.cgi?id=57120">Bug 57120</a>
-</p>
diff --git a/tests/tests/webkitsecurity/assets/delayed-style-mutation-event-crash.html b/tests/tests/webkitsecurity/assets/delayed-style-mutation-event-crash.html
deleted file mode 100644
index fabb7a0..0000000
--- a/tests/tests/webkitsecurity/assets/delayed-style-mutation-event-crash.html
+++ /dev/null
@@ -1,11 +0,0 @@
-<html>
-<div id="foo"><p id="bar">FAILURE</p></div>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-var bar = document.getElementById("bar");
-var foo = document.getElementById("foo");
-bar.style.color = "green";
-foo.innerHTML = "SUCCESS (You didn't crash)";
-</script>
-</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/delete-insignificant-text-crash.html b/tests/tests/webkitsecurity/assets/delete-insignificant-text-crash.html
deleted file mode 100644
index cc93630..0000000
--- a/tests/tests/webkitsecurity/assets/delete-insignificant-text-crash.html
+++ /dev/null
@@ -1,29 +0,0 @@
-<!DOCTYPE html>
-<html>
-<body>
-<p>This tests deleting a node in DOMCharacterDataModified doesn't result in a crash.</p>
-<div id="test" contenteditable></div>
-<script>
-
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-var test = document.getElementById('test');
-test.appendChild(document.createTextNode('a  '));
-test.appendChild(document.createTextNode('  '));
-test.appendChild(document.createTextNode('b'));
-test.appendChild(document.createTextNode('  '));
-getSelection().setPosition(test.firstChild.nextSibling, 0);
-document.body.addEventListener('DOMCharacterDataModified', function () {
-    test.removeChild(test.firstChild.nextSibling);
-    if (window.GCController)
-        GCController.collect();
-}, false);
-document.execCommand("InsertText", false, "c");
-
-test.textContent = '';
-document.writeln('PASS');
-
-</script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/destroy-cell-with-selection-crash.html b/tests/tests/webkitsecurity/assets/destroy-cell-with-selection-crash.html
deleted file mode 100644
index 8010ef7..0000000
--- a/tests/tests/webkitsecurity/assets/destroy-cell-with-selection-crash.html
+++ /dev/null
@@ -1,17 +0,0 @@
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
-Test doing display:none for a cell in table with selection. This passes if it does not crash.
-<table style="border-collapse: collapse">
-    <td id=c0></td>
-    <td id=c1></td>
-</table>
-<script>
-var c0 = document.getElementById('c0');
-var c1 = document.getElementById('c1');
-var selection = window.getSelection();
-selection.setBaseAndExtent(c0, 0, c1, 0);
-c1.style.display = 'none';
-</script>
-
diff --git a/tests/tests/webkitsecurity/assets/destroy-counter-crash.html b/tests/tests/webkitsecurity/assets/destroy-counter-crash.html
deleted file mode 100644
index 9601c96..0000000
--- a/tests/tests/webkitsecurity/assets/destroy-counter-crash.html
+++ /dev/null
@@ -1,29 +0,0 @@
-<html>

-  <head>

-    <style type="text/css">

-    div { counter-reset: c }

-    iframe { counter-reset: c }

-    h1:after { content: counter(c) }

-    </style>

-    <script>

-    if (window.layoutTestController)

-        layoutTestController.dumpAsText();

-

-    window.onload = function () {

-        var testElement = document.getElementById("test");

-        document.body.removeChild(testElement);

-        var p = document.createElement("p");

-        p.appendChild(document.createTextNode("TEST PASSED"));

-        document.body.appendChild(p);

-    }

-    </script>

-  </head>

-  <body>

-  This test is to ensure that we do not crash when destroying counter nodes.

-    <div id="test">

-      <iframe/>

-      <h1/>

-    </div>

-  </body>

-</html>

- 

diff --git a/tests/tests/webkitsecurity/assets/destroy-selected-radio-button-crash.html b/tests/tests/webkitsecurity/assets/destroy-selected-radio-button-crash.html
deleted file mode 100644
index 04b65a6..0000000
--- a/tests/tests/webkitsecurity/assets/destroy-selected-radio-button-crash.html
+++ /dev/null
@@ -1,17 +0,0 @@
-<html>
-<script>
-function runTest() {
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    document.getElementById('container').innerHTML = '';
-    document.getElementById('radio').checked = true;
-}
-</script>
-<body onload="runTest()">
-    <div>This tests that destroying a checked radio button that does not have a form correctly removes the radio button element from the checked radio buttons map. This test should ideally be run with GuardMalloc or a similar memory checker.</div>
-    <div>SUCCESS - Didn't crash!</div>
-    <div id="container"><input name="a" type="radio" checked></div>
-    <input name="a" id="radio" type="radio">
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/detached-object-notification-crash.html b/tests/tests/webkitsecurity/assets/detached-object-notification-crash.html
deleted file mode 100644
index da90024..0000000
--- a/tests/tests/webkitsecurity/assets/detached-object-notification-crash.html
+++ /dev/null
@@ -1,48 +0,0 @@
-<html>
-<head>
-    <script src="../../../fast/js/resources/js-test-pre.js"></script>
-</head>
-
-<body id="body">
-
-<input id="avnElement">
-<input id="avnElement2">
-
-<p>This tests that posting a notification for a deleted element does
-not cause a crash.</p>
-
-<p id="notDRT">This test should only be run inside of DumpRenderTree.</p>
-
-<p id="console"></p>
-
-<script>
-    function notificationReceived(event)
-    {
-        if (event != "value change event")
-            return;
-
-        debug("PASS: Didn't crash.");
-        layoutTestController.notifyDone();
-    }
-    if (window.layoutTestController && window.accessibilityController) {
-        document.getElementById("notDRT").style.visibility = "hidden";
-
-        layoutTestController.dumpAsText();
-        layoutTestController.waitUntilDone();
-
-        var element = document.getElementById("avnElement");
-        element.focus();
-
-        element.setAttribute("aria-valuenow", 2);
-        document.getElementById("body").removeChild(element);
-
-        var element2 = document.getElementById("avnElement2");
-        element2.focus();
-
-        accessibilityController.focusedElement.addNotificationListener(notificationReceived);
-
-        element2.setAttribute("aria-valuenow", 2);
-    }
-</script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/detached-outermost-svg-crash.html b/tests/tests/webkitsecurity/assets/detached-outermost-svg-crash.html
deleted file mode 100644
index 08be168..0000000
--- a/tests/tests/webkitsecurity/assets/detached-outermost-svg-crash.html
+++ /dev/null
@@ -1,13 +0,0 @@
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-var svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
-for (prop in svg) {
-    // Access all the properties on the <svg> element
-    // at least one of them (like viewport) will call SVGSVGElement::isOutermostSVG()
-    // and will trigger the crash seen in https://bugs.webkit.org/show_bug.cgi?id=25105
-    svg[prop];
-}
-</script>
-<div>PASSED -- webkit did not crash in SVGSVGElement::isOutermostSVG().  See https://bugs.webkit.org/show_bug.cgi?id=25105</div>
diff --git a/tests/tests/webkitsecurity/assets/details-children-merge-crash.html b/tests/tests/webkitsecurity/assets/details-children-merge-crash.html
deleted file mode 100644
index 6e82056..0000000
--- a/tests/tests/webkitsecurity/assets/details-children-merge-crash.html
+++ /dev/null
@@ -1,31 +0,0 @@
-
-<script>
-
-var runTests = function () {
-
-    if (!window.layoutTestController)
-        return;
-
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-
-    var d = document.getElementById("d1");
-
-    setTimeout(function () {
-        d.open = false;
-        setTimeout(function () {
-            d.open = true;
-            setTimeout(function () {
-                d.open = false;
-                layoutTestController.notifyDone();
-            }, 1);
-        }, 1);
-    }, 1);
-};
-
-</script>
-
-<body onload="runTests()">
-    Test passes if it does not crash.
-    <li><details open id="d1">some text</details></li>
-</body>
diff --git a/tests/tests/webkitsecurity/assets/details-element-render-inline-crash.html b/tests/tests/webkitsecurity/assets/details-element-render-inline-crash.html
deleted file mode 100644
index 159cf0d..0000000
--- a/tests/tests/webkitsecurity/assets/details-element-render-inline-crash.html
+++ /dev/null
@@ -1,14 +0,0 @@
-<html>

-<head>

-<script>

-    if (window.layoutTestController)

-        layoutTestController.dumpAsText();

-</script>

-</head>

-<body>

-<style>

-   .control { display: inline; }

-</style>

-PASS<details class="control"><p><a></p></details>

-</body>

-</html>

diff --git a/tests/tests/webkitsecurity/assets/device-orientation-crash.html b/tests/tests/webkitsecurity/assets/device-orientation-crash.html
deleted file mode 100644
index 3127634..0000000
--- a/tests/tests/webkitsecurity/assets/device-orientation-crash.html
+++ /dev/null
@@ -1,45 +0,0 @@
-<html>

-<script>

-var frame;

-

-if (!window.gc) {

-    window.gc = function() {

-        if (window.GCController)

-            return GCController.collect();

-        for (var i = 0; i < 10000; i++) {

-            var s = new String("abc");

-        }

-    }

-}

-

-function done() {

-    document.body.innerHTML = 'PASS: handler not supported or did not crash when removing Windows during ondeviceorientation event';

-    if (window.layoutTestController)

-        layoutTestController.notifyDone();

-}

-

-function remove() {

-    frame = null;

-    document.body.innerHTML = '';

-    gc();

-    setTimeout(done, 0);

-}

-

-function crash() {

-    if (window.layoutTestController) {

-        layoutTestController.dumpAsText();

-        layoutTestController.waitUntilDone();

-    }

-

-    frame = document.createElement('iframe');

-    document.body.appendChild(frame);

-

-    if (!frame.contentWindow.ondeviceorientation)

-        done();

-    else

-        frame.contentWindow.ondeviceorientation = remove;

-}

-</script>

-<body onload="crash()">

-</body>

-</html>

diff --git a/tests/tests/webkitsecurity/assets/dirty-inline-textbox-crash.html b/tests/tests/webkitsecurity/assets/dirty-inline-textbox-crash.html
deleted file mode 100644
index d0cc04b..0000000
--- a/tests/tests/webkitsecurity/assets/dirty-inline-textbox-crash.html
+++ /dev/null
@@ -1,21 +0,0 @@
-<html>

-    <head>

-        <style>

-            .box

-            {

-                display: run-in; 

-                -webkit-padding-start: 10000;

-            }

-        </style>

-    </head>

-    <body>

-        <div class="box">PASS</div>

-        <div class="box"></div>

-        <div class="box"></div>

-        <div></div>

-        <script>

-            if (window.layoutTestController)

-                layoutTestController.dumpAsText();

-        </script>

-    </body>

-</html>

diff --git a/tests/tests/webkitsecurity/assets/dispatchEvent-crash.html b/tests/tests/webkitsecurity/assets/dispatchEvent-crash.html
deleted file mode 100644
index b55e248..0000000
--- a/tests/tests/webkitsecurity/assets/dispatchEvent-crash.html
+++ /dev/null
@@ -1,36 +0,0 @@
-<p>This is a test for https://bugs.webkit.org/show_bug.cgi?id=21063 (NULL pointer crash in dispatchEvent(null)).  It passes if it does not crash.</p>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    // FIXME: this should also test WorkerContext and MessagePort.
-    var eventTargets = [new XMLHttpRequest, (new XMLHttpRequest).upload, window.applicationCache, new Worker("about:blank"), document.body];
-
-    for (var i = 0; i < eventTargets.length; ++i) {
-        eventTarget = eventTargets[i];
-        try {
-            eventTarget.dispatchEvent(null);
-        } catch(e) {
-        }
-    
-        try {
-            eventTarget.dispatchEvent(undefined);
-        } catch(e) {
-        }
-    
-        try {
-            eventTarget.dispatchEvent("string");
-        } catch(e) {
-        }
-    
-        try {
-            eventTarget.dispatchEvent(0);
-        } catch(e) {
-        }
-    
-        try {
-            eventTarget.dispatchEvent({});
-        } catch(e) {
-        }
-    }
-</script>
diff --git a/tests/tests/webkitsecurity/assets/display-none-inline-style-change-crash.html b/tests/tests/webkitsecurity/assets/display-none-inline-style-change-crash.html
deleted file mode 100644
index 0e44873..0000000
--- a/tests/tests/webkitsecurity/assets/display-none-inline-style-change-crash.html
+++ /dev/null
@@ -1,16 +0,0 @@
-<style>
-    /* dummy descendant rule */
-    span li { color: red; }
-</style>
-<p>
-    Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=15887">http://bugs.webkit.org/show_bug.cgi?id=15887</a> REGRESSION (r27576): Crash in RenderStyle::affectedByHoverRules clicking link on Digg</i>.
-</p>
-<p>
-    This test should not crash.
-</p>
-<div id="target" style="display: none;"></div>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-    document.getElementById("target").style.color = "blue";
-</script>
diff --git a/tests/tests/webkitsecurity/assets/div-within-anchors-causes-crash.html b/tests/tests/webkitsecurity/assets/div-within-anchors-causes-crash.html
deleted file mode 100644
index 7d4c266..0000000
--- a/tests/tests/webkitsecurity/assets/div-within-anchors-causes-crash.html
+++ /dev/null
@@ -1,66 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN"> 
-<html> 
-<head>
-<script> 
-
-    function buildAccessibilityTree(accessibilityObject, indent) {
-        var str = "";
-        for (var i = 0; i < indent; i++)
-            str += "    ";
-        str += accessibilityObject.role;
-        str += " " + accessibilityObject.stringValue;
-        str += "\n";
-        document.getElementById("tree").innerText += str;
-
-        if (accessibilityObject.stringValue.indexOf('End of test') >= 0)
-            return false;
-
-        var count = accessibilityObject.childrenCount;
-        for (var i = 0; i < count; ++i) {
-            if (!buildAccessibilityTree(accessibilityObject.childAtIndex(i), indent + 1))
-                return false;
-        }
-
-        return true;
-    }
-</script> 
-<script src="../fast/js/resources/js-test-pre.js"></script> 
-</head> 
-<body> 
- 
-<a><div></div></a>
-
-<a><div></div></a>
-
-<a href="about:blank"><div></div></a> 
-
-<div>End of test</div>
-
-<pre id="tree"></pre>
- 
-<p id="description"></p> 
-<div id="console"></div> 
- 
-<script> 
-    description("This can cause a crash.");
- 
-    if (window.accessibilityController) {
-        // First build up full accessibility tree.
-        document.getElementById("tree").innerText += "Before:\n";
-        document.body.focus();
-        buildAccessibilityTree(accessibilityController.focusedElement, 0);
-        
-        // Remove anchor that causes debug assert in AccessibilityRenderObject::addChildren
-        document.body.removeChild(document.body.children[2])
-        
-        // Build up full accessibility tree again.
-        document.getElementById("tree").innerText += "After:\n";
-        document.body.focus();
-        buildAccessibilityTree(accessibilityController.focusedElement, 0);
-    }
- 
-</script> 
- 
-<script src="../fast/js/resources/js-test-post.js"></script> 
-</body> 
-</html> 
diff --git a/tests/tests/webkitsecurity/assets/doctype-event-listener-crash.html b/tests/tests/webkitsecurity/assets/doctype-event-listener-crash.html
deleted file mode 100644
index 8e849d4..0000000
--- a/tests/tests/webkitsecurity/assets/doctype-event-listener-crash.html
+++ /dev/null
@@ -1,11 +0,0 @@
-<p>This page tests for a crash when adding an event listener to a doctype node.</p>
-<p>If the test passes, you'll see a PASS message below.</p>
-
-<pre>PASS: You didn't crash.</pre>
-
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-var doctype = document.implementation.createDocumentType("html", 0, 0);
-doctype.addEventListener("click", function () { }, false);
-</script>
diff --git a/tests/tests/webkitsecurity/assets/document-deactivation-callback-crash.html b/tests/tests/webkitsecurity/assets/document-deactivation-callback-crash.html
deleted file mode 100644
index d8b535e..0000000
--- a/tests/tests/webkitsecurity/assets/document-deactivation-callback-crash.html
+++ /dev/null
@@ -1,41 +0,0 @@
-<p>
-    Test for a crash when deactivating a document that had adopted a &lt;form>
-    element.
-</p>
-<p>
-    The test passed if it did not crash.
-</p>
-<iframe id="iframe"></iframe>
-<script>
-    var iframe = document.getElementById("iframe");
-
-    onload = function()
-    {
-        if (window.layoutTestController) {
-            layoutTestController.dumpAsText();
-            layoutTestController.waitUntilDone();
-        }
-
-        document.body.offsetTop;
-        var otherDocument = iframe.contentDocument;
-        var form = document.createElement("form");
-        otherDocument.adoptNode(form);
-        form = null;
-        setTimeout(finish, 0);
-    }
-
-    function finish()
-    {
-        if (window.GCController)
-            GCController.collect()
-        else {
-            for (var i = 0; i < 10000; i++)
-                var foo = { };
-        }
-
-        iframe.parentNode.removeChild(iframe);
-
-        if (window.layoutTestController)
-            layoutTestController.notifyDone();
-    }
-</script>
diff --git a/tests/tests/webkitsecurity/assets/domstring-replace-crash.html b/tests/tests/webkitsecurity/assets/domstring-replace-crash.html
deleted file mode 100644
index 3862982..0000000
--- a/tests/tests/webkitsecurity/assets/domstring-replace-crash.html
+++ /dev/null
@@ -1,22 +0,0 @@
-<?xml version="1.0" encoding="EUC-JP"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-<html xmlns="http://www.w3.org/1999/xhtml" lang="en">
-<head>
-<script type="text/javascript">
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
-<title>
-</title>
-</head>
-<body>
-<p>
-This test checks for a regression against
-<i><a href="https://bugs.webkit.org/show_bug.cgi?id=6236">https://bugs.webkit.org/show_bug.cgi?id=6236</a> REGRESSION: Crash in DOMString::replace() in ToT (12/25/05)</i>.
-</p>
-No crash = test PASS.
-</p>
-<form>
-<input type="text"/>
-</form>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/domurl-script-execution-context-crash.html b/tests/tests/webkitsecurity/assets/domurl-script-execution-context-crash.html
deleted file mode 100644
index 36f2d19..0000000
--- a/tests/tests/webkitsecurity/assets/domurl-script-execution-context-crash.html
+++ /dev/null
@@ -1,30 +0,0 @@
-<html>
-<script>
-function crash()
-{
-    try {
-        e.apply(w, ['webkitURL']);
-    } catch (ex) { }
-    document.body.innerHTML = "PASS: null security context for DOMURL did not crash";
-    if (window.layoutTestController)
-        layoutTestController.notifyDone();
-}
-
-function load()
-{
-    w.close();
-    setTimeout(crash, 30);
-}
-
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.setCanOpenWindows();
-    layoutTestController.setCloseRemainingWindowsWhenComplete(true);
-    layoutTestController.waitUntilDone();
-}
-
-e = (w = open()).eval;
-</script>
-<body onload="load()">
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/dont-crash-with-null-gif-frames.html b/tests/tests/webkitsecurity/assets/dont-crash-with-null-gif-frames.html
deleted file mode 100644
index a630c3c..0000000
--- a/tests/tests/webkitsecurity/assets/dont-crash-with-null-gif-frames.html
+++ /dev/null
@@ -1,6 +0,0 @@
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
-This tests passes if it doesn't crash.<br>
-<img src=resources/quicksort.gif>
diff --git a/tests/tests/webkitsecurity/assets/double-merge-anonymous-block-crash.html b/tests/tests/webkitsecurity/assets/double-merge-anonymous-block-crash.html
deleted file mode 100644
index 949ddc9..0000000
--- a/tests/tests/webkitsecurity/assets/double-merge-anonymous-block-crash.html
+++ /dev/null
@@ -1,27 +0,0 @@
-<html>

-    <head>

-        <script>

-            if (window.layoutTestController)

-                layoutTestController.dumpAsText();

-        </script>

-    </head>

-    <style>

-    div { 

-        border: 5px solid maroon; 

-        -webkit-column-count: 2;

-        margin: 1em 0;

-    }

-    summary { 

-        -webkit-column-span: all;

-        background-color: #eeeeee;

-        color: black;

-    }

-    </style>

-    <body onload="document.open(); document.write('PASS, does not crash'); document.close();">

-        <div>

-            <label>AAA

-            <summary>BBB

-        </div>

-    </body>

-</html>

-

diff --git a/tests/tests/webkitsecurity/assets/doubleclick-crash-expected.png b/tests/tests/webkitsecurity/assets/doubleclick-crash-expected.png
deleted file mode 100644
index ee6421a..0000000
--- a/tests/tests/webkitsecurity/assets/doubleclick-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/doubleclick-crash.html b/tests/tests/webkitsecurity/assets/doubleclick-crash.html
deleted file mode 100644
index 2acac37..0000000
--- a/tests/tests/webkitsecurity/assets/doubleclick-crash.html
+++ /dev/null
@@ -1,52 +0,0 @@
-<html>
-<head>
-<script>
-if (window.layoutTestController)
-     layoutTestController.dumpEditingCallbacks();
-</script>
-
-<style>
-body { margin: 0; padding: 0 }
-</style>
-<script type="text/javascript">
-function step4()
-{
-    eventSender.mouseUp();
-    layoutTestController.notifyDone();
-}
-
-function step3()
-{
-    eventSender.mouseDown();
-    window.setTimeout(step4, 1);
-}
-
-function step2()
-{
-    eventSender.mouseUp();
-    window.setTimeout(step3, 100);
-}
-
-function step1()
-{
-    eventSender.mouseDown();
-    window.setTimeout(step2, 1);
-}
-
-function step0()
-{
-    eventSender.mouseMoveTo(50, 10);
-    window.setTimeout(step1, 1);
-}
-
-step0();
-layoutTestController.waitUntilDone();
-</script>
-</head>
-<body>
-<pre>
-Test.
-Test.
-</body>
-</html>
-<!-- http://bugzilla.opendarwin.org/show_bug.cgi?id=3739 - only testing for crashing, not the actual results. -->
diff --git a/tests/tests/webkitsecurity/assets/doubleclick-whitespace-crash-expected.png b/tests/tests/webkitsecurity/assets/doubleclick-whitespace-crash-expected.png
deleted file mode 100644
index 6f484eb..0000000
--- a/tests/tests/webkitsecurity/assets/doubleclick-whitespace-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/doubleclick-whitespace-crash.html b/tests/tests/webkitsecurity/assets/doubleclick-whitespace-crash.html
deleted file mode 100644
index 31a60fb..0000000
--- a/tests/tests/webkitsecurity/assets/doubleclick-whitespace-crash.html
+++ /dev/null
@@ -1,30 +0,0 @@
-<html>
-<head>
-<script>
-if (window.layoutTestController) {
-     layoutTestController.dumpAsText();
-     layoutTestController.setSmartInsertDeleteEnabled(false);
-     layoutTestController.setSelectTrailingWhitespaceEnabled(true);
-}
-</script>
-</head>
-<body>
-<pre>
-Double-click in the white space below this text block -- should not crash.
-<a href="https://bugs.webkit.org/show_bug.cgi?id=23232">BUG 23232</a>.
-</pre> 
-<script type="text/javascript">
-    if (window.layoutTestController) {
-        // Double click at the end of the body.
-        eventSender.mouseMoveTo(10, 100);
-        eventSender.mouseDown();
-        eventSender.mouseUp();
-        eventSender.mouseDown();
-        eventSender.mouseUp();
-
-        // As long as didn't crash, we passed.
-        document.write("PASS");
-    }
-</script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/doubleclick-whitespace-img-crash-expected.png b/tests/tests/webkitsecurity/assets/doubleclick-whitespace-img-crash-expected.png
deleted file mode 100644
index 5cbdfe9..0000000
--- a/tests/tests/webkitsecurity/assets/doubleclick-whitespace-img-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/doubleclick-whitespace-img-crash.html b/tests/tests/webkitsecurity/assets/doubleclick-whitespace-img-crash.html
deleted file mode 100644
index a63f89e..0000000
--- a/tests/tests/webkitsecurity/assets/doubleclick-whitespace-img-crash.html
+++ /dev/null
@@ -1,39 +0,0 @@
-<html>
-<head>
-<script>
-if (window.layoutTestController) {
-     layoutTestController.dumpAsText();
-     layoutTestController.setSmartInsertDeleteEnabled(false);
-     layoutTestController.setSelectTrailingWhitespaceEnabled(true);
-     layoutTestController.waitUntilDone();
-}
-
-function startTest() {
-     if (window.layoutTestController) {
-          // The IFRAME has loaded with an image in it. Double click
-          // in any of the space around the image in the IFRAME.
-          // (The image is 76 x 103 pixels big).
-          eventSender.mouseMoveTo(150, 150);
-          eventSender.mouseDown();
-          eventSender.mouseUp();
-          eventSender.mouseDown();
-          eventSender.mouseUp();
-
-          // As long as didn't crash, we passed.
-          document.body.innerHTML = "PASS";
-          layoutTestController.notifyDone();
-     }
-}
-</script>
-</head>
-<body onload="startTest()">
-
-<iframe src="../resources/abe.png" style="width: 300px; height: 300px"></iframe>
-
-<p>
-Double-click in the white space around the image -- should not crash or access invalid memory.
-<a href="https://bugs.webkit.org/show_bug.cgi?id=25335">BUG 25335</a>.
-</p> 
-
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/drag-and-drop-dataTransfer-types-nocrash.html b/tests/tests/webkitsecurity/assets/drag-and-drop-dataTransfer-types-nocrash.html
deleted file mode 100644
index 2128e40..0000000
--- a/tests/tests/webkitsecurity/assets/drag-and-drop-dataTransfer-types-nocrash.html
+++ /dev/null
@@ -1,138 +0,0 @@
-<html>
-<head>
-<script src="../js/resources/js-test-pre.js"></script>
-<style>
-#dropTarget, #dragMe { text-align: center; display: table-cell; vertical-align: middle }
-#dropTarget {width: 256px; height: 256px; border: 1px dashed}
-#dragMe {-webkit-user-drag: element; -webkit-user-select: none; background: #ff0000; width: 64px; height: 64px; color: white}
-</style>
-<script>
-    var dragMe;
-    var dropTarget;
-    var consoleElm;
-    var event;
-    
-    var FORMAT_TYPE = 'text/plain';
-    var ALLOWED_EFFECT = 'copy';
-    var DROP_EFFECT = 'copy';
-    
-    window.onload = function()
-    {
-        dragMe = document.getElementById("dragMe");
-        dropTarget = document.getElementById("dropTarget");
-        consoleElm = document.getElementById("console");
-        
-        if (!dragMe || !dropTarget || !consoleElm)
-            return;
-        
-        dragMe.ondragstart = dragStart;
-        dragMe.ondragend = dragEnd;
-        
-        dropTarget.ondragenter = dragEntered;
-        dropTarget.ondragover = dragOver;
-        dropTarget.ondrop = drop;
-        
-        runTest();
-    }
-    
-    function dragStart(e)
-    {
-        event = e;
-        e.dataTransfer.effectAllowed = ALLOWED_EFFECT;
-        e.dataTransfer.setData(FORMAT_TYPE, e.target.textContent);
-    }
-    
-    function dragEnd(e)
-    {
-        return;
-    }
-    
-    function dragEntered(e)
-    {
-        dragEnteredAndUpdated(e);
-    }
-    
-    function dragOver(e)
-    {
-        dragEnteredAndUpdated(e);
-    }
-    
-    function dragEnteredAndUpdated(e)
-    {
-        event = e;
-        e.dataTransfer.dropEffect = DROP_EFFECT;
-        cancelDrag(e);
-    }
-    
-    function drop(e)
-    {
-        checkFormatType(e);
-        cancelDrag(e);
-    }
-    
-    function cancelDrag(e)
-    {
-        if (e.preventDefault)
-            e.preventDefault();
-        else {
-            // Assume this script is executing within Internet Explorer
-            e.returnValue = false;
-        }
-    }
-    
-    function checkFormatType(e)
-    {
-        event = e;
-        var formatTypes = e.dataTransfer.types; // This line causes the crash.
-        if (event.dataTransfer.types.indexOf(FORMAT_TYPE) == -1)
-            testFailed('event.dataTransfer.types should contain format "' + FORMAT_TYPE + '", but it does not.');
-        else
-            testPassed('event.dataTransfer.types contains format "' + FORMAT_TYPE + '"');
-
-        if (event.dataTransfer.getData(FORMAT_TYPE) != 'Square')
-            testFailed('event.dataTransfer.getData("' + FORMAT_TYPE + '") should contain "Square", but it does not.');
-        else
-            testPassed('event.dataTransfer.getData("' + FORMAT_TYPE + '") contains "Square"');
-    }
-
-    function runTest()
-    {
-        if (!window.eventSender)
-            return;
-            
-        if (window.layoutTestController)
-            layoutTestController.dumpAsText();
-            
-        var startX = dragMe.offsetLeft + 10;
-        var startY = dragMe.offsetTop + dragMe.offsetHeight / 2;
-        var endX = dropTarget.offsetLeft + 10;
-        var endY = dropTarget.offsetTop + dropTarget.offsetHeight / 2;
-        
-        eventSender.mouseMoveTo(startX, startY);
-        eventSender.mouseDown();
-        eventSender.leapForward(100);
-        eventSender.mouseMoveTo(endX, endY);
-        eventSender.mouseUp();
-        
-        var testContainer = document.getElementById("test-container");
-        if (testContainer)
-            document.body.removeChild(testContainer);
-        debug('<br /><span class="pass">TEST COMPLETE</span>');
-    }
-</script>
-</head>
-<body>
-    <p id="description"></p>
-    <div id="test-container">
-        <div id="dropTarget">Drop the red square onto me.</div>
-        <hr/>
-        <p>Items that can be dragged to the drop target:</p>
-        <div id="dragMe" draggable="true">Square</div>
-        <hr/>
-    </div>
-    <div id="console"></div>
-    <script>
-        description("This test checks that on a successful drop we can access <code>event.dataTransfer.types</code> without crashing.");
-    </script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/drag-drop-iframe-refresh-crash.html b/tests/tests/webkitsecurity/assets/drag-drop-iframe-refresh-crash.html
deleted file mode 100644
index d7311d7..0000000
--- a/tests/tests/webkitsecurity/assets/drag-drop-iframe-refresh-crash.html
+++ /dev/null
@@ -1,58 +0,0 @@
-<html>
-<head>
-<script>
-if (window.layoutTestController) {
-    layoutTestController.waitUntilDone();
-    layoutTestController.dumpAsText();
-}
-
-function log(message) {
-    var console = document.getElementById("console");
-    var li = document.createElement("li");
-    var text = document.createTextNode(message);
-    
-    console.appendChild(li);
-    li.appendChild(text);
-}
-
-function runTest() {
-
-    var doc = window.frames[0].document;
-    e = doc.getElementById("dragme");
-    xdrag = e.offsetLeft + e.offsetWidth / 2;
-    ydrag = e.offsetTop + e.offsetHeight / 2;
-    e = doc.getElementById("target");
-    xdrop = e.offsetLeft + e.offsetWidth / 2;
-    ydrop = e.offsetTop + e.offsetHeight / 2;
-
-    var timer = setInterval(function() {
-                                window.frames[0].location = "../resources/drag-drop.html";
-                            }, 100);
-
-    if (!window.layoutTestController) {
-        log("This test uses eventSender. To run it manually, drag the selected image to another position in the editable div and drop it. Renderer should not crash.");
-        return;
-    }
-    
-    var max_tries = 50; 
-    for (i = 0; i < max_tries; i++) {
-         eventSender.mouseMoveTo(xdrag, ydrag);
-         eventSender.mouseDown();    
-         eventSender.mouseMoveTo(xdrop, ydrop);
-         eventSender.mouseUp();
-    }
-
-    clearInterval(timer);
-
-    document.write("<p>Bug 37618: Crash when an image drag-drop operation happens inside a continuously refreshing iframe.</p>");
-    document.write("<p>SUCCESS</p>");
-
-    layoutTestController.notifyDone();
-}
-</script>
-</head>
-<body onload="runTest()">
-<iframe src="../resources/drag-drop.html"></iframe>
-<ul id="console"></ul>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/drag-file-crash.html b/tests/tests/webkitsecurity/assets/drag-file-crash.html
deleted file mode 100644
index 4250be2..0000000
--- a/tests/tests/webkitsecurity/assets/drag-file-crash.html
+++ /dev/null
@@ -1,32 +0,0 @@
-<style>
-    #scroller {
-        height: 1000px;
-    }
-</style>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    function moveMouseToCenterOfElement(element)
-    {
-        var centerX = element.offsetLeft + element.offsetWidth / 2;
-        var centerY = element.offsetTop + element.offsetHeight / 2;
-        eventSender.mouseMoveTo(centerX, centerY);
-    }
-
-    function run()
-    {
-        window.scrollBy(0, 1000);
-        if (window.eventSender) {
-            eventSender.beginDragWithFiles(["resources/abe.png"]);
-            var fileInput = document.getElementById('file');
-            moveMouseToCenterOfElement(fileInput);
-            eventSender.mouseUp();
-        }
-    }
-</script>
-<body onload="run()">
-<div id="scroller"></div>
-<input type="file" id="file">
-This is a test for https://bugs.webkit.org/show_bug.cgi?id=29276. It passes if it does not crash. If not run from DRT, drag a file onto the file input.
-</body>
diff --git a/tests/tests/webkitsecurity/assets/drag-over-iframe-invalid-source-crash.html b/tests/tests/webkitsecurity/assets/drag-over-iframe-invalid-source-crash.html
deleted file mode 100644
index 3d37326..0000000
--- a/tests/tests/webkitsecurity/assets/drag-over-iframe-invalid-source-crash.html
+++ /dev/null
@@ -1,22 +0,0 @@
-<head>
-<script>
-window.onload = function () {
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText(); 
-
-    var abe = document.getElementById("abe");
-    var dragTarget = document.getElementById("dragTarget");
-
-    eventSender.mouseMoveTo(abe.offsetLeft + 50, abe.offsetTop + 50);
-    eventSender.mouseDown();
-    eventSender.leapForward(500);
-    eventSender.mouseMoveTo(dragTarget.offsetLeft + 10, dragTarget.offsetTop + 10);
-    eventSender.mouseUp();
-}
-</script>
-</head>
-
-<p>This page tests that we don't crash if we drag something to an iframe that has an invalid source.</p>
-<img id="abe" src="http://127.0.0.1:8000/security/resources/abe.png">
-<div>SUCCESS - didn't crash</div>
-<iframe id="dragTarget" src="file:"></iframe> 
diff --git a/tests/tests/webkitsecurity/assets/duplicate-html-element-crash.html b/tests/tests/webkitsecurity/assets/duplicate-html-element-crash.html
deleted file mode 100644
index 216f1a9..0000000
--- a/tests/tests/webkitsecurity/assets/duplicate-html-element-crash.html
+++ /dev/null
@@ -1,17 +0,0 @@
-<body onload="runTest()">
-<script>
-function runTest() {
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-        
-    var div = document.createElement('div');
-    div.appendChild(document.body.parentElement);
-    var a = document.createElement('a');
-    a.innerHTML = '<x><html></html>'; 
-    
-    document.appendChild(document.createElement('html'))
-    document.documentElement.innerHTML='<div>This tests that we won\'t crash when creating a new html element when the document does not ' +
-        'have a document element.</div><div>SUCCESS - Did not crash!</div>'
-}
-</script>
-</body>
diff --git a/tests/tests/webkitsecurity/assets/duplicate-param-crash.html b/tests/tests/webkitsecurity/assets/duplicate-param-crash.html
deleted file mode 100644
index 859a901..0000000
--- a/tests/tests/webkitsecurity/assets/duplicate-param-crash.html
+++ /dev/null
@@ -1,10 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="script-tests/duplicate-param-crash.js"></script>
-<script src="resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/duplicate-param-crash.js b/tests/tests/webkitsecurity/assets/duplicate-param-crash.js
deleted file mode 100644
index 6b9a1df..0000000
--- a/tests/tests/webkitsecurity/assets/duplicate-param-crash.js
+++ /dev/null
@@ -1,19 +0,0 @@
-description(
-'Tests to ensure that activations are built correctly in the face of duplicate parameter names and do not cause crashes.'
-);
-
-function test1(a, b, b, b, b, b, b) {
-    return function() {
-        return a;
-    }
-}
-
-shouldBe('test1("success")()', '"success"');
-
-function test2(a, a, a, a, a, a, b) {
-    return function() {
-        return b;
-    }
-}
-
-shouldBe('test2("success", "success", "success", "success", "success", "success", "success")()', '"success"');
diff --git a/tests/tests/webkitsecurity/assets/duplicate-param-gc-crash.html b/tests/tests/webkitsecurity/assets/duplicate-param-gc-crash.html
deleted file mode 100644
index 40cedfc..0000000
--- a/tests/tests/webkitsecurity/assets/duplicate-param-gc-crash.html
+++ /dev/null
@@ -1,10 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="script-tests/duplicate-param-gc-crash.js"></script>
-<script src="resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/duplicate-param-gc-crash.js b/tests/tests/webkitsecurity/assets/duplicate-param-gc-crash.js
deleted file mode 100644
index c11806a..0000000
--- a/tests/tests/webkitsecurity/assets/duplicate-param-gc-crash.js
+++ /dev/null
@@ -1,47 +0,0 @@
-description(
-'Tests to ensure that activations are built correctly in the face of duplicate parameter names and do not cause crashes.'
-);
-
-function gc()
-{
-    if (this.GCController)
-        GCController.collect();
-    else
-        for (var i = 0; i < 10000; ++i) // Allocate a sufficient number of objects to force a GC.
-            ({});
-}
-
-function eatRegisters(param)
-{
-    if (param > 10)
-        return;
-    eatRegisters(param + 1);
-}
-
-function test1(a, b, b, b, b, b, b) {
-    return function() {
-        return a[0];
-    }
-}
-
-var test1Closure = test1(["success"]);
-
-var extra = test1("success");
-eatRegisters(0);
-gc();
-
-shouldBe('test1Closure()', '"success"');
-
-function test2(a, a, a, a, a, a, b) {
-    return function() {
-        return b[0];
-    }
-}
-
-var test2Closure = test2("success", "success", "success", "success", "success", "success", ["success"]);
-extra =  test2("success", "success", "success", "success", "success", "success", ["success"]);
-
-eatRegisters(0);
-gc();
-
-shouldBe('test2Closure()', '"success"');
diff --git a/tests/tests/webkitsecurity/assets/dynamic-marker-crash-expected.png b/tests/tests/webkitsecurity/assets/dynamic-marker-crash-expected.png
deleted file mode 100644
index 2dfcdd8..0000000
--- a/tests/tests/webkitsecurity/assets/dynamic-marker-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/dynamic-marker-crash.html b/tests/tests/webkitsecurity/assets/dynamic-marker-crash.html
deleted file mode 100644
index 94dc792..0000000
--- a/tests/tests/webkitsecurity/assets/dynamic-marker-crash.html
+++ /dev/null
@@ -1,31 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
-     "http://www.w3.org/TR/html4/strict.dtd">
-<html>
-	<head>
-		<title>Test</title>
-		<script type="text/javascript">
-			function displayOnOff(el)
-			{
-		  		el.style.display = (el.style.display == 'block') ? 'none' : 'block';
-			}
-		</script>
-	</head>
-	<body>
-		
-	<!-- Removing the <ul> and <li> elements will make this work in Safari! -->
-	<ul>
-	  <li> 
-		<form action="./" id="myform" method="get" style="display:none">
-			<p><input id="tag_list" name="tag_list"	size="40" type="text" value="blah blubb" >
-			</p>
-		</form>
-		<p>There should be an input field above this line of text.</a></p>
-	  </li>
-	</ul>
-<script>
-document.body.offsetLeft
-displayOnOff(document.getElementById('myform'))
-document.body.offsetLeft
-</script>
-	</body>
-</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/editable-non-editable-crash-expected.png b/tests/tests/webkitsecurity/assets/editable-non-editable-crash-expected.png
deleted file mode 100644
index b59174d..0000000
--- a/tests/tests/webkitsecurity/assets/editable-non-editable-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/editable-non-editable-crash.html b/tests/tests/webkitsecurity/assets/editable-non-editable-crash.html
deleted file mode 100644
index 88d8328..0000000
--- a/tests/tests/webkitsecurity/assets/editable-non-editable-crash.html
+++ /dev/null
@@ -1,20 +0,0 @@
-<head>
-<script>
-if (window.layoutTestController)
-     layoutTestController.dumpEditingCallbacks();
-</script>
-<style>
-table, td {
-    border: 1px solid #aaa;
-}
-</style></head>
-<body>
-<div contenteditable="true"><table style="border: 1px solid #aaa" id="base"><tr><td id="extent" contenteditable="false">This tests for a Mail crasher that happened when a selection was created with one endpoint in non-editable content and the other in editable content.</td></tr></table></div>
-
-<script>
-var s = window.getSelection();
-var b = document.getElementById("base");
-var e = document.getElementById("extent");
-s.setBaseAndExtent(b, 0, e, 0);
-</script>
-</body>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/editing-command-while-executing-typing-command-crash.html b/tests/tests/webkitsecurity/assets/editing-command-while-executing-typing-command-crash.html
deleted file mode 100644
index ada1db0..0000000
--- a/tests/tests/webkitsecurity/assets/editing-command-while-executing-typing-command-crash.html
+++ /dev/null
@@ -1,18 +0,0 @@
-<script>
-window.onload = function() {
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    document.execCommand("selectall", false);
-    document.designMode="on";
-    document.execCommand("insertparagraph", false);
-    document.execCommand("InsertText", false);
-
-    document.firstChild.appendChild(document.createElement('body'));
-    document.body.innerText = "This tests executing an editing command while executing a typing command.\nPASS";
-};
-
-document.addEventListener("DOMNodeRemovedFromDocument",
-    function() { document.execCommand("JustifyNone", false); },true);
-
-</script>
diff --git a/tests/tests/webkitsecurity/assets/editing-nontext-node-crash.xhtml b/tests/tests/webkitsecurity/assets/editing-nontext-node-crash.xhtml
deleted file mode 100644
index 964b5f1..0000000
--- a/tests/tests/webkitsecurity/assets/editing-nontext-node-crash.xhtml
+++ /dev/null
@@ -1,36 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">

-    <head> 

-        <script>//<![CDATA[

-            if (window.layoutTestController)

-                layoutTestController.dumpAsText();

-

-            var selection = window.getSelection();

-            function runEditingTest() {

-                var elem = document.getElementById("test2");

-                selection.setPosition(elem, 0);

-                for (i = 0; i < 21; i++)

-                    selection.modify("move", "forward", "character");

-                document.execCommand("Delete");

-                

-                // Test completed without crash.

-                document.getElementById("test1").removeChild(elem);

-                document.getElementById("result").innerHTML = "PASS";

-            }

-        //]]></script>                   

-    </head>  

-    <body onload="runEditingTest()">

-        <p>This tests passes if it does not crash.</p>

-        <div id="result"></div>

-        <div id="test1" contenteditable="">

-            <span id="test2">Something Something <br/>

-                <svg xmlns="http://www.w3.org/2000/svg">

-                    <html xmlns="http://www.w3.org/1999/xhtml">

-                        <body>

-                        </body>

-                    </html>

-                </svg>

-            </span>

-        </div>

-    </body>  

-</html>

-

diff --git a/tests/tests/webkitsecurity/assets/element-instance-held-by-js-crash.svg b/tests/tests/webkitsecurity/assets/element-instance-held-by-js-crash.svg
deleted file mode 100644
index ddf4690..0000000
--- a/tests/tests/webkitsecurity/assets/element-instance-held-by-js-crash.svg
+++ /dev/null
@@ -1,27 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
-    <script>
-    <![CDATA[
-    window.onload = function() {
-        // Grab a reference to an SVGElementInstance native object. This reference will prevent the
-        // object from deletion when the shadow DOM is removed due to a style change.
-        instance = document.getElementById("use_elem").instanceRoot;
-
-        // Setting an attribute forces re-creation of the shadow DOM
-        document.getElementById("circleID").setAttribute("cx", 30);
-
-        // The animate element tries to modify the element, which tries to update the
-        // instances in the circle, which crashes if it holds a pointer to a non-existent element.
-
-        if (window.layoutTestController)
-            layoutTestController.dumpAsText();
-    }
-    //]]>
-    </script>
-    <circle transform="translate(1)" id="circleID" fill="green" cy="15" cx="15" r="10" >
-        <animate attributeName="cy" />
-    </circle>
-    <text id="resultText" y="20" x="50" >
-      PASS - Null corresponding element dereference does not crash.
-    </text>
-    <use id="use_elem" xlink:href="#circleID" />
-</svg>
diff --git a/tests/tests/webkitsecurity/assets/element-removal-crash.xhtml b/tests/tests/webkitsecurity/assets/element-removal-crash.xhtml
deleted file mode 100644
index 2ac0e12..0000000
--- a/tests/tests/webkitsecurity/assets/element-removal-crash.xhtml
+++ /dev/null
@@ -1,31 +0,0 @@
-<span xmlns="http://www.w3.org/1999/xhtml">
-<span/>
-<style>
-    span 
-    {
-        counter-increment: counter;
-    }
-    span:before
-    {
-        content: counter(counter);
-    }
-</style>
-<script>
-    if (window.layoutTestController) 
-    {
-        layoutTestController.dumpAsText();
-        layoutTestController.waitUntilDone();
-    }
-
-    function runTest()
-    {
-        document.documentElement.textContent = "PASS";
-
-        if (window.layoutTestController)
-            layoutTestController.notifyDone();
-    }
-
-    setTimeout('runTest()', 0);
-</script>
-<span/>
-
diff --git a/tests/tests/webkitsecurity/assets/embed-bidi-style-in-isolate-crash.html b/tests/tests/webkitsecurity/assets/embed-bidi-style-in-isolate-crash.html
deleted file mode 100755
index 54c74c3..0000000
--- a/tests/tests/webkitsecurity/assets/embed-bidi-style-in-isolate-crash.html
+++ /dev/null
@@ -1,11 +0,0 @@
-<bdi>
-    <ruby>PASS, if no exception or crash in debug</ruby>
-    <em  dir="ltr">
-        <embed></embed>
-        <audio onerror="open()" src="foo"></audio>
-    </em>
-</bdi>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
diff --git a/tests/tests/webkitsecurity/assets/embedCrasher.html b/tests/tests/webkitsecurity/assets/embedCrasher.html
deleted file mode 100644
index 49b9f43..0000000
--- a/tests/tests/webkitsecurity/assets/embedCrasher.html
+++ /dev/null
@@ -1,8 +0,0 @@
-<embed src='doesnotexist'>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-    alert("PASS: If you see this and the test did not crash the test has passed. (rdar://problem/5267870)");
-</script>
-<frameset>
-<frame>
diff --git a/tests/tests/webkitsecurity/assets/empty-anonymous-block-remove-crash.html b/tests/tests/webkitsecurity/assets/empty-anonymous-block-remove-crash.html
deleted file mode 100644
index 23328fa..0000000
--- a/tests/tests/webkitsecurity/assets/empty-anonymous-block-remove-crash.html
+++ /dev/null
@@ -1,29 +0,0 @@
-<html>

-    <head>

-        <script>

-            if (window.layoutTestController)

-            {

-                layoutTestController.dumpAsText();

-                layoutTestController.waitUntilDone();

-            }

-        

-            function runTest()

-            {

-                var button = document.getElementById("test");

-                button.insertBefore(document.createElement("tbody"));

-                document.body.offsetTop;

-                document.body.removeChild(button);

-                

-                var result = document.createElement("div");

-                result.innerHTML = "PASS";

-                document.body.appendChild(result);

-                if (window.layoutTestController)

-                    layoutTestController.notifyDone();

-            }

-        </script>

-    </head>

-    <body onload="runTest()">

-        <button id="test"/>

-    </body>

-</html>

-

diff --git a/tests/tests/webkitsecurity/assets/empty-bdi-crash.html b/tests/tests/webkitsecurity/assets/empty-bdi-crash.html
deleted file mode 100644
index 5adf37b..0000000
--- a/tests/tests/webkitsecurity/assets/empty-bdi-crash.html
+++ /dev/null
@@ -1,13 +0,0 @@
-<!DOCTYPE html>
-<html>
-<body>
-This test ensures WebKit does not crash when encountering an empty bdi element.
-<bdi></bdi>
-<script>
-
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-</script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/empty-content-with-float-crash.html b/tests/tests/webkitsecurity/assets/empty-content-with-float-crash.html
deleted file mode 100644
index 8909041..0000000
--- a/tests/tests/webkitsecurity/assets/empty-content-with-float-crash.html
+++ /dev/null
@@ -1,17 +0,0 @@
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-<style>
-    span::after {content: ''; }
-</style>
-<p>
-    Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=17988">http://bugs.webkit.org/show_bug.cgi?id=17988</a>
-    REGRESSION (r31114-31132): Crash in InlineBox::isDirty() opening chowhound.com</i>.
-</p>
-<p>
-    No crash means PASS.
-</p>
-<span>
-    <div style="float: left;"></div>
-</span>
diff --git a/tests/tests/webkitsecurity/assets/empty-first-line-crash.html b/tests/tests/webkitsecurity/assets/empty-first-line-crash.html
deleted file mode 100644
index e4b7a04..0000000
--- a/tests/tests/webkitsecurity/assets/empty-first-line-crash.html
+++ /dev/null
@@ -1,12 +0,0 @@
-<!DOCTYPE html>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
-<style>
-*:empty:first-line { background: red; }
-</style>
-<div>
-Tests that the :empty pseudo-class doesn't cause a crash when the empty status changes during parsing.
-<button autofocus></button>
-</div>
diff --git a/tests/tests/webkitsecurity/assets/empty-mroot-crash.xhtml b/tests/tests/webkitsecurity/assets/empty-mroot-crash.xhtml
deleted file mode 100644
index f4f2bbb..0000000
--- a/tests/tests/webkitsecurity/assets/empty-mroot-crash.xhtml
+++ /dev/null
@@ -1,15 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML" xml:lang="en">
-<head>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-</head>
-<body>
-<math xmlns="http://www.w3.org/1998/Math/MathML">
-    <mtext>This test passes if it does not crash.</mtext> 
-    <mroot></mroot>
-</math>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/empty-msubsup-crash.html b/tests/tests/webkitsecurity/assets/empty-msubsup-crash.html
deleted file mode 100644
index 61d4904..0000000
--- a/tests/tests/webkitsecurity/assets/empty-msubsup-crash.html
+++ /dev/null
@@ -1,17 +0,0 @@
-<html>
-<head>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-</head>
-<body>
-
-<p>This test passes if it does not crash.</p>
-
-<math xmlns="http://www.w3.org/1998/Math/MathML">
-    <msubsup></msubsup>
-</math>
-
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/empty-render-surface-crasher.html b/tests/tests/webkitsecurity/assets/empty-render-surface-crasher.html
deleted file mode 100644
index d83a75f..0000000
--- a/tests/tests/webkitsecurity/assets/empty-render-surface-crasher.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE>
-<html>
-<head>
-<title>Empty Render Surface</title>
-  <style type="text/css" media="screen">
-    .container {
-      position: relative;
-      height: 0x;
-      width: 0px;
-      opacity:0.5;
-    }
-    
-    .child {
-      -webkit-transform: translateZ(0);
-      height: 0px;
-      width: 0px;
-      background-color: red;
-    }    
-  </style>
-  <script type="text/javascript" charset="utf-8">
-    if (window.layoutTestController)
-      layoutTestController.dumpAsText();
-  </script>
-
-</head>
-<body>
-<p>This page tests that an empty render surface does not crash as reported in <a href='https://bugs.webkit.org/show_bug.cgi?id=51432'>this bug</a>. Pass if this does not crash.</p>
-
-<div class="container">
-  <div class="child"> </div>
-</div>
-
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/empty-row-crash-expected.png b/tests/tests/webkitsecurity/assets/empty-row-crash-expected.png
deleted file mode 100644
index 8763576..0000000
--- a/tests/tests/webkitsecurity/assets/empty-row-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/empty-row-crash.html b/tests/tests/webkitsecurity/assets/empty-row-crash.html
deleted file mode 100644
index c60ed6a..0000000
--- a/tests/tests/webkitsecurity/assets/empty-row-crash.html
+++ /dev/null
@@ -1,13 +0,0 @@
-<html>
-<body>
-<table id="obj">
-<script>
-obj.createTFoot();
-obj.deleteTFoot();
-obj.focus();
-obj.insertRow();
-obj.insertRow();
-</script>
-This test passes if it does not crash.
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/empty-section-crash-expected.png b/tests/tests/webkitsecurity/assets/empty-section-crash-expected.png
deleted file mode 100644
index 567a8a3..0000000
--- a/tests/tests/webkitsecurity/assets/empty-section-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/empty-section-crash.html b/tests/tests/webkitsecurity/assets/empty-section-crash.html
deleted file mode 100644
index 7438134..0000000
--- a/tests/tests/webkitsecurity/assets/empty-section-crash.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<html>
-<head>
-    <title></title>
-    <script type="text/javascript">
-        function finish()
-        {
-            /* Since the crash happens in painting code, force painting. This
-               makes the test work even when run without the --pixel option. */
-            layoutTestController.display();
-            layoutTestController.notifyDone();
-        }
-
-        function test()
-        {
-            if (window.layoutTestController) {
-                layoutTestController.waitUntilDone();
-                setTimeout(finish, 0);
-            }
-        }
-    </script>
-</head>
-<body onload="test();">
-    <p>
-        Test for <i><a href="https://bugs.webkit.org/show_bug.cgi?id=9009">http://bugzilla.opendarwin.org/show_bug.cgi?id=9009</a>
-        REGRESSION: ToT crash in WebCore at Zap2it</i>.
-    </p>
-    <p>
-        No crash means PASS.
-    </p>
-    <table style="position: absolute; top: -6px; border-collapse: collapse; border-top: 10px solid; width: 100px; height: 100px;">
-    <tbody></tbody>
-    <tbody><tr><td></td></tr></tbody>
-    </table>
-</body>
diff --git a/tests/tests/webkitsecurity/assets/empty-webkit-mask-crash-expected.png b/tests/tests/webkitsecurity/assets/empty-webkit-mask-crash-expected.png
deleted file mode 100644
index b5daa85..0000000
--- a/tests/tests/webkitsecurity/assets/empty-webkit-mask-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/empty-webkit-mask-crash.html b/tests/tests/webkitsecurity/assets/empty-webkit-mask-crash.html
deleted file mode 100644
index 3d8062a..0000000
--- a/tests/tests/webkitsecurity/assets/empty-webkit-mask-crash.html
+++ /dev/null
@@ -1,12 +0,0 @@
-<script>
-    // We need to dump the image to get the crash but we don't care about the layout information.
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText(true);
-</script>
-<style>
-*{
-    -webkit-mask-image:none,none,url(x);
-}
-</style>
-<p style="position:absolute; top: -1000px">https://bugs.webkit.org/show_bug.cgi?id=50151 : Crash in RenderBox::paintMaskImages due to a mask without an associated image<br>
-The test passes if it does not CRASH (normally the output is a white page)</p>
diff --git a/tests/tests/webkitsecurity/assets/empty-worker-nocrash.html b/tests/tests/webkitsecurity/assets/empty-worker-nocrash.html
deleted file mode 100644
index 29cd0e1..0000000
--- a/tests/tests/webkitsecurity/assets/empty-worker-nocrash.html
+++ /dev/null
@@ -1,11 +0,0 @@
-<html>
-<script>
-var worker = new Worker('about:blank');
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-}
-setTimeout('window.layoutTestController.notifyDone()', 20);
-</script>
-<p>PASS</p>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/end-of-buffer-crash.html b/tests/tests/webkitsecurity/assets/end-of-buffer-crash.html
deleted file mode 100644
index 6f69e83..0000000
--- a/tests/tests/webkitsecurity/assets/end-of-buffer-crash.html
+++ /dev/null
@@ -1,12 +0,0 @@
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
-
-<style>tenbytes {</style>
-
-<p>This test tickles a subtle off-by-one bug in how the CSS lexer handles end
-of buffer conditions.  The contents of the style tag satisfy (length mod 8 = 2)
-and contain an unclosed curly brace.  We pass if we don't crash.</p>
-
-<p>PASS</p>
diff --git a/tests/tests/webkitsecurity/assets/eval-cache-crash.html b/tests/tests/webkitsecurity/assets/eval-cache-crash.html
deleted file mode 100644
index 983f971..0000000
--- a/tests/tests/webkitsecurity/assets/eval-cache-crash.html
+++ /dev/null
@@ -1,10 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="script-tests/eval-cache-crash.js"></script>
-<script src="resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/eval-cache-crash.js b/tests/tests/webkitsecurity/assets/eval-cache-crash.js
deleted file mode 100644
index bc8eb7e..0000000
--- a/tests/tests/webkitsecurity/assets/eval-cache-crash.js
+++ /dev/null
@@ -1,15 +0,0 @@
-description(
-"Test to make sure the eval code cache doesn't crash or give wrong results in odd situations."
-);
-
-
-var str = "(function () { return a; })";
-var a = "first";
-var first = eval(str)();
-shouldBe("first", "'first'");
-
-with ({a : "second"}) {
-    var second = eval(str)();
-}
-
-shouldBe("second", "'second'");
diff --git a/tests/tests/webkitsecurity/assets/event-listener-map-rehash-crash.html b/tests/tests/webkitsecurity/assets/event-listener-map-rehash-crash.html
deleted file mode 100644
index c9018d7..0000000
--- a/tests/tests/webkitsecurity/assets/event-listener-map-rehash-crash.html
+++ /dev/null
@@ -1,23 +0,0 @@
-<html>
-<head>
-<script src="../js/resources/js-test-pre.js"></script>
-<script>
-    function stub() {}
-
-    document.addEventListener("DOMContentLoaded", function()
-    {
-        for (var i = 0; i < 50; ++i)
-            document.addEventListener("boom" + i, stub, false);
-    }, false);
-
-    document.addEventListener("DOMContentLoaded", stub);
-</script>
-</head>
-<body>
-<script>
-    description("Ensures that rehashing of events map doesn't leave us with a dangling event list reference.");
-    testPassed("Did not crash.");
-</script>
-<script src="../js/resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/eventsource-reconnect-during-navigate-crash.html b/tests/tests/webkitsecurity/assets/eventsource-reconnect-during-navigate-crash.html
deleted file mode 100644
index 68aef92..0000000
--- a/tests/tests/webkitsecurity/assets/eventsource-reconnect-during-navigate-crash.html
+++ /dev/null
@@ -1,20 +0,0 @@
-<html>
-<body>
-<p>Navigate while an EventSource reconnect timer is waiting, then have the reconnect timer trigger before the page unloads. We pass if we don't crash.
-<script>
-if (window.layoutTestController) {
-    layoutTestController.waitUntilDone();
-    layoutTestController.dumpAsText();
-}
-
-function navigate() {
-    window.location = "resources/wait-then-notify-done.php";
-}
-
-var es = new EventSource("resources/reconnect.php");
-es.onerror = function() {
-    setTimeout(navigate, 0);
-};
-</script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/exception-codegen-crash.html b/tests/tests/webkitsecurity/assets/exception-codegen-crash.html
deleted file mode 100644
index 71f03e1..0000000
--- a/tests/tests/webkitsecurity/assets/exception-codegen-crash.html
+++ /dev/null
@@ -1,21 +0,0 @@
-<p>This page tests some conditions that used to cause crashes during codegen.
-</p>
-<p>If you don't crash, you pass.
-</p>
-
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-var scripts = [
-    "(1++).x;",
-    "/^[s{-.[]()]$/.x;",
-    "(++1).x;",
-    "(1 = 1).x;"
-];
-
-try {
-    eval(scripts.join("\n"));
-} catch (e) {
-}
-</script>
diff --git a/tests/tests/webkitsecurity/assets/exception-no-frame-inline-script-crash-iframe.html b/tests/tests/webkitsecurity/assets/exception-no-frame-inline-script-crash-iframe.html
deleted file mode 100644
index 3df8f4e..0000000
--- a/tests/tests/webkitsecurity/assets/exception-no-frame-inline-script-crash-iframe.html
+++ /dev/null
@@ -1,16 +0,0 @@
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function crash()
-{
-    /* Ensure we have no frame when the exception is thrown. */
-    var iframe = parent.document.getElementById("iframe");
-    iframe.parentNode.removeChild(iframe);
-    
-    /* Throw an exception. */
-    throw "crash";
-}
-
-crash();
-</script>
diff --git a/tests/tests/webkitsecurity/assets/exception-no-frame-inline-script-crash.html b/tests/tests/webkitsecurity/assets/exception-no-frame-inline-script-crash.html
deleted file mode 100644
index 3fd8b28..0000000
--- a/tests/tests/webkitsecurity/assets/exception-no-frame-inline-script-crash.html
+++ /dev/null
@@ -1,11 +0,0 @@
-<p>This test checks for a crash when throwing an exception under the following
-conditions: (1) The throwing script's document has no frame; (2) The script is
-inline in the document.
-</p>
-
-<hr>
-
-<p>PASS: You didn't crash.
-</p>
-
-<iframe id="iframe" src='resources/exception-no-frame-inline-script-crash-iframe.html'></iframe>
diff --git a/tests/tests/webkitsecurity/assets/exception-no-frame-timeout-crash-iframe.html b/tests/tests/webkitsecurity/assets/exception-no-frame-timeout-crash-iframe.html
deleted file mode 100644
index c1386fc..0000000
--- a/tests/tests/webkitsecurity/assets/exception-no-frame-timeout-crash-iframe.html
+++ /dev/null
@@ -1,13 +0,0 @@
-<script>
-function crash()
-{
-    /* Ensure we have no frame when the exception is thrown. */
-    var iframe = parent.document.getElementById("iframe");
-    iframe.parentNode.removeChild(iframe);
-    
-    /* Throw an exception. */
-    throw "crash";
-}
-
-setTimeout(crash, 0);
-</script>
diff --git a/tests/tests/webkitsecurity/assets/exception-no-frame-timeout-crash.html b/tests/tests/webkitsecurity/assets/exception-no-frame-timeout-crash.html
deleted file mode 100644
index 97ca6b5..0000000
--- a/tests/tests/webkitsecurity/assets/exception-no-frame-timeout-crash.html
+++ /dev/null
@@ -1,16 +0,0 @@
-<p>This test checks for a crash when throwing an exception under the following
-conditions: (1) The throwing script's document has no frame; (2) The script is run 
-from a timeout.
-</p>
-
-<hr>
-
-<p>PASS: You didn't crash.
-</p>
-
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
-
-<iframe id="iframe" src='exception-no-frame-timeout-crash-iframe.html'></iframe>
diff --git a/tests/tests/webkitsecurity/assets/existent-eventsource-status-error-iframe-crash.html b/tests/tests/webkitsecurity/assets/existent-eventsource-status-error-iframe-crash.html
deleted file mode 100644
index 08cc5ab..0000000
--- a/tests/tests/webkitsecurity/assets/existent-eventsource-status-error-iframe-crash.html
+++ /dev/null
@@ -1,27 +0,0 @@
-<html>
-  <iframe id="test"></iframe>
-  <div id="result"></div>
-  <script>
-    if (window.layoutTestController)
-    {
-      layoutTestController.dumpAsText();
-      layoutTestController.waitUntilDone();
-    }
-
-    function runTest()
-    {
-      document.getElementById("test").src = "resources/request-existent-eventsource-error.html";
-    }
-
-    function finish()
-    {
-      document.body.removeChild(document.getElementById("test"));
-  
-      document.getElementById("result").innerHTML = "PASS";
-      if (window.layoutTestController)
-        layoutTestController.notifyDone();
-    }
-
-    runTest();
-  </script>
-<html>
diff --git a/tests/tests/webkitsecurity/assets/extend-by-line-anonymous-content-crash-expected.png b/tests/tests/webkitsecurity/assets/extend-by-line-anonymous-content-crash-expected.png
deleted file mode 100644
index f105d92..0000000
--- a/tests/tests/webkitsecurity/assets/extend-by-line-anonymous-content-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/extend-by-line-anonymous-content-crash.html b/tests/tests/webkitsecurity/assets/extend-by-line-anonymous-content-crash.html
deleted file mode 100644
index 7a8f12d..0000000
--- a/tests/tests/webkitsecurity/assets/extend-by-line-anonymous-content-crash.html
+++ /dev/null
@@ -1,17 +0,0 @@
-<style>
-    #b:before { content: "bar"; }
-</style>
-<p>
-    Test for <a href="rdar://problem/6081309">rdar://problem/6081309</a>, a crash when moving or extending the selection with line granularity.
-</p>
-<div id="target">foo</div>
-<div id="b">baz</div>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    var sel = getSelection();
-    var start = document.getElementById("target").firstChild;
-    sel.setBaseAndExtent(start, 0, start, 1);
-    sel.modify("extend", "forward", "line");
-</script>
diff --git a/tests/tests/webkitsecurity/assets/extend-over-file-input-by-drag-crash.html b/tests/tests/webkitsecurity/assets/extend-over-file-input-by-drag-crash.html
deleted file mode 100644
index 6e8fd7a..0000000
--- a/tests/tests/webkitsecurity/assets/extend-over-file-input-by-drag-crash.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE>

-<html>

-<body>

-<p>This test ensures WebKit does not crash when selecting text across an element with type=file.

-To manually test, start selection in "start" and extend the selection by dragging to "end" moving across the input element.

-WebKit should not crash.</p>

-<span id="test">start<input type=file>end</span>

-<script>

-

-if (window.layoutTestController && window.eventSender) {

-    layoutTestController.dumpAsText();

-

-    var test = document.getElementById('test');

-    var input = test.getElementsByTagName('input')[0];

-

-    var y = test.offsetTop + test.offsetHeight / 2;

-    eventSender.mouseMoveTo(test.offsetLeft + 5, y);

-    eventSender.mouseDown();

-

-    eventSender.leapForward(200);

-    eventSender.mouseMoveTo(input.offsetLeft + input.offsetWidth / 2, y);

-    eventSender.leapForward(200);

-

-    eventSender.mouseMoveTo(test.offsetLeft + test.offsetWidth - 5, y);

-    eventSender.mouseDown();

-

-    test.parentNode.removeChild(test);

-

-    document.write('PASS');

-}

-

-</script>

-</body>

-</html>

diff --git a/tests/tests/webkitsecurity/assets/feComponentTransfer-style-crash.xhtml b/tests/tests/webkitsecurity/assets/feComponentTransfer-style-crash.xhtml
deleted file mode 100644
index d9d78a1..0000000
--- a/tests/tests/webkitsecurity/assets/feComponentTransfer-style-crash.xhtml
+++ /dev/null
@@ -1,29 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-<body>
-<svg xmlns="http://www.w3.org/2000/svg">
-<script>
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-}
-window.onload = function()
-{
-    try {
-        document.getElementById('tgt').type.baseVal=99999;
-    } catch (e) {
-        alert (e);
-    }
-
-    setTimeout(function () {
-            document.body.innerHTML = "PASS";
-            if (window.layoutTestController)
-                layoutTestController.notifyDone();
-        }, 0);
-}
-</script>
-<defs><filter id="f"><feComponentTransfer><feFuncR type="identity" id="tgt"/></feComponentTransfer></filter></defs>
-<text x="20" y="20" filter="url(#f)" style="fill:green" id="out">TESTING</text>
-<rect width="128" height="128" style="fill:green" filter="url(#f)"/>
-</svg>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/feDisplacementMap-crash-test.xhtml b/tests/tests/webkitsecurity/assets/feDisplacementMap-crash-test.xhtml
deleted file mode 100644
index 8fa2ca8..0000000
--- a/tests/tests/webkitsecurity/assets/feDisplacementMap-crash-test.xhtml
+++ /dev/null
@@ -1,29 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-<body>
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
-<script>
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-}
-
-window.onload = function()
-{
-    try {
-        document.getElementById('d').xChannelSelector.baseVal=0x80000000;
-        document.getElementById('d').yChannelSelector.baseVal=0x40000000;
-    } catch(e) {
-        alert (e);
-    }
-
-    setTimeout(function () {
-            document.body.innerHTML = "PASS";
-            layoutTestController.notifyDone();
-        }, 0);
-}
-</script>
-<defs><filter id="f"><feDisplacementMap id="d"/></filter></defs>
-<rect width="128" height="128" style="fill:rgb(0,255,0)" filter="url(#f)"/> 
-</svg>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/feImage-zero-size-crash.svg b/tests/tests/webkitsecurity/assets/feImage-zero-size-crash.svg
deleted file mode 100644
index e124a0d..0000000
--- a/tests/tests/webkitsecurity/assets/feImage-zero-size-crash.svg
+++ /dev/null
@@ -1,22 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 400 400">
-    <title>This test passes if it doesn't crash.</title>
-    <text id="log" />
-    <defs>
-        <circle id="circle" r="0" fill="red" />
-        <filter id="image">
-            <feImage xlink:href="#circle" />
-        </filter>
-    </defs>
-    <rect x="0" y="0" width="100" height="100" filter="url(#image)" />
-    <rect x="100" y="100" width="100" height="100" fill="green" />
-    <script>
-      <![CDATA[
-        if (window.layoutTestController)
-            layoutTestController.dumpAsText();
-
-        var log = document.getElementById("log");
-        log.appendChild(document.createTextNode("PASS"));
-    ]]>
-    </script>
-</svg>
diff --git a/tests/tests/webkitsecurity/assets/feLighting-crash-expected.png b/tests/tests/webkitsecurity/assets/feLighting-crash-expected.png
deleted file mode 100644
index 62b197f..0000000
--- a/tests/tests/webkitsecurity/assets/feLighting-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/feLighting-crash.svg b/tests/tests/webkitsecurity/assets/feLighting-crash.svg
deleted file mode 100644
index cbe2e1d..0000000
--- a/tests/tests/webkitsecurity/assets/feLighting-crash.svg
+++ /dev/null
@@ -1,13 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg">
-
-<defs>
-<filter id="light" primitiveUnits="userSpaceOnUse">
-<feSpecularLighting lighting-color="blue" surfaceScale="5" specularConstant="10" specularExponent="6">
-    <feDistantLight azimuth="0" elevation="30"/>
-</feSpecularLighting>
-</filter>
-</defs>
-
-<rect width="40" height="20" filter="url(#light)" fill="black"/>
-
-</svg>
diff --git a/tests/tests/webkitsecurity/assets/fenced-whitespace-separators-crash.html b/tests/tests/webkitsecurity/assets/fenced-whitespace-separators-crash.html
deleted file mode 100644
index ce87b7e..0000000
--- a/tests/tests/webkitsecurity/assets/fenced-whitespace-separators-crash.html
+++ /dev/null
@@ -1,21 +0,0 @@
-<html>
-<head>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-</head>
-
-<body>
-<math>
-    <mfenced separators=" ">
-        <mrow>
-            <mrow>
-                <mi>v</mi>
-            </mrow>
-            <mi>i</mi>
-        </mrow>
-    </mfenced>
-</math>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/file-reader-directory-crash.html b/tests/tests/webkitsecurity/assets/file-reader-directory-crash.html
deleted file mode 100644
index 9550cb4..0000000
--- a/tests/tests/webkitsecurity/assets/file-reader-directory-crash.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<html>
-<body>
-<input type=file id=file onchange='onInputFileChange()'>
-<p id=status>To test manually, drag a directory to the file input above.</p>
-<script>
-var input = document.getElementsByTagName("input")[0];
-var statusElement = document.getElementById("status");
-
-function onInputFileChange()
-{
-    var file = document.getElementById('file').files[0];
-    var reader = new FileReader();
-    statusElement.textContent = "Starting test...";
-    reader.readAsText(file);
-    reader.onloadend = function() {
-        statusElement.textContent = "PASS, no crash";
-        if (window.layoutTestController)
-            layoutTestController.notifyDone();
-    }
-}
-
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-}
-
-eventSender.beginDragWithFiles(['resources']);
-eventSender.mouseMoveTo(input.offsetLeft + 1, input.offsetTop + 1);
-eventSender.mouseUp();
-
-</script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/filesystem-no-callback-null-ptr-crash.html b/tests/tests/webkitsecurity/assets/filesystem-no-callback-null-ptr-crash.html
deleted file mode 100644
index ff4b9b1..0000000
--- a/tests/tests/webkitsecurity/assets/filesystem-no-callback-null-ptr-crash.html
+++ /dev/null
@@ -1,19 +0,0 @@
-<!--
-  http://code.google.com/p/chromium/issues/detail?id=63204
-  https://bugs.webkit.org/show_bug.cgi?id=49539
--->
-<div id="log">FAIL</div>
-<script>
-  if (window.layoutTestController)
-      layoutTestController.dumpAsText();
-  if (window.webkitRequestFileSystem) {
-      // These two calls should throw an exception but should NOT cause a NULL pointer crash:
-      webkitResolveLocalFileSystemURL('');
-      try {
-          webkitRequestFileSystem(TEMPORARY, 100);
-      }
-      catch(e) {
-          document.getElementById('log').innerHTML = "PASS";
-      }
-  }
-</script>
diff --git a/tests/tests/webkitsecurity/assets/fill-layer-crash.html b/tests/tests/webkitsecurity/assets/fill-layer-crash.html
deleted file mode 100644
index 5867b62b..0000000
--- a/tests/tests/webkitsecurity/assets/fill-layer-crash.html
+++ /dev/null
@@ -1,25 +0,0 @@
-<html>
-<head id="head">
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
-<style>
-* {background-image:inherit;}
-</style>
-</head>
-<body>
- <span></span>
-</body>
-<script>
-document.body.style.background="-webkit-canvas(foo)";
-var head = document.getElementById("head");
-style = document.createElement("style");
-style.type = "text/css";
-var rule = document.createTextNode("* {content:counter(mycount_id)}");
-style.appendChild(rule);
-head.appendChild(style);
-document.body.setAttribute("style","line-height:128mm;");
-</script>
-This test works if it doesn't crash.
-</html>
diff --git a/tests/tests/webkitsecurity/assets/filter-after-transform-crash.svg b/tests/tests/webkitsecurity/assets/filter-after-transform-crash.svg
deleted file mode 100644
index 654c8b7..0000000
--- a/tests/tests/webkitsecurity/assets/filter-after-transform-crash.svg
+++ /dev/null
@@ -1,22 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="80" y="80" width="300" height="180" viewBox="0 0 200 120">
-    <script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-    </script>
-    <defs>
-        <filter id="MyFilter" filterUnits="userSpaceOnUse" >
-            <feGaussianBlur />
-            <feOffset />
-            <feSpecularLighting >
-                <fePointLight />
-            </feSpecularLighting>
-            <feComposite />
-            <feMerge>
-                <feMergeNode />
-                <feMergeNode />
-            </feMerge>
-        </filter>
-    </defs>
-    <g transform="matrix(0,-256152301,1000,0,1,1) " filter="url(#MyFilter)" />
-    <text>PASS - Applying filter does not crash.</text>
-</svg>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/filter-empty-element-crash-expected.png b/tests/tests/webkitsecurity/assets/filter-empty-element-crash-expected.png
deleted file mode 100644
index b649c59..0000000
--- a/tests/tests/webkitsecurity/assets/filter-empty-element-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/filter-empty-element-crash.html b/tests/tests/webkitsecurity/assets/filter-empty-element-crash.html
deleted file mode 100644
index 1bb3161..0000000
--- a/tests/tests/webkitsecurity/assets/filter-empty-element-crash.html
+++ /dev/null
@@ -1,6 +0,0 @@
-<script>
-if (window.layoutTestController)
-    window.layoutTestController.dumpAsText(true);
-</script>
-<div style="-webkit-filter: blur(1px);" width="0px" height="0px"></div>
-<p>If you can read this, the test passed.</p>
diff --git a/tests/tests/webkitsecurity/assets/find-layout-crash.html b/tests/tests/webkitsecurity/assets/find-layout-crash.html
deleted file mode 100644
index 6af5cf2..0000000
--- a/tests/tests/webkitsecurity/assets/find-layout-crash.html
+++ /dev/null
@@ -1,26 +0,0 @@
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
-<p>Test case for
-<a href="https://bugs.webkit.org/show_bug.cgi?id=32842"
-   >https://bugs.webkit.org/show_bug.cgi?id=26088</a>.
-The test passes if there is no crash.
-<TEXTAREA id="container">
-
-
-sit
-</TEXTAREA>down
-
-<SCRIPT>
-    document.execCommand("FindString", true, "s");
-    document.execCommand("FindString", true, "n");
-</SCRIPT>
-
-<STYLE></STYLE>
-
-<script type="text/javascript">
-    e=document.getElementById('container');
-    e.innerHTML="";
-</script>
-
diff --git a/tests/tests/webkitsecurity/assets/first-letter-anonymous-block-crash.html b/tests/tests/webkitsecurity/assets/first-letter-anonymous-block-crash.html
deleted file mode 100644
index 3c21504..0000000
--- a/tests/tests/webkitsecurity/assets/first-letter-anonymous-block-crash.html
+++ /dev/null
@@ -1,15 +0,0 @@
-<html>
-<style type=text/css>
-dd:first-letter { content:""; }
-dir:first-letter { text-align:""; }
-</style>
-<dd>
-<dir>
-<font>
-<form>
-No crash means PASS
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/first-letter-block-form-controls-crash.html b/tests/tests/webkitsecurity/assets/first-letter-block-form-controls-crash.html
deleted file mode 100644
index a032da7..0000000
--- a/tests/tests/webkitsecurity/assets/first-letter-block-form-controls-crash.html
+++ /dev/null
@@ -1,35 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<style>
-    .capitalize:first-letter {
-        text-transform: uppercase;
-    }
-    .block {
-        display: block;
-    }
-</style>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-</head>
-<body>
-    <p>
-        Test case for <a href="https://bugs.webkit.org/show_bug.cgi?id=34641">Bug 34641</a>.
-    </p>
-
-    <div class="capitalize"><input class="block" type="submit"></div>
-    <div class="capitalize"><select class="block"><option>foo</select></div>
-    <div class="capitalize"><input class="block" type="text" value="foo"></div>
-    <div class="capitalize"><input class="block" type="checkbox"></div>
-    <div class="capitalize"><input class="block" type="radio"></div>
-    <div class="capitalize"><input class="block" type="file"></div>
-    <div class="capitalize"><textarea class="block"></textarea></div>
-    <div class="capitalize"><video class="block" controls></video></div>
-    <div class="capitalize"><audio class="block" controls></audio></div>
-    <!-- this makes WebKit recalc style -->
-    <style></style>
-    <p>No crash means PASS</p>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/first-letter-inline-flow-split-crash.html b/tests/tests/webkitsecurity/assets/first-letter-inline-flow-split-crash.html
deleted file mode 100755
index ec2b887..0000000
--- a/tests/tests/webkitsecurity/assets/first-letter-inline-flow-split-crash.html
+++ /dev/null
@@ -1,41 +0,0 @@
-<style>
-.spanStyle { float: inherit; }
-.inlineFL::first-letter { visibility: visible; }
-.floatFL { float: right; }
-.floatFL::first-letter { position: absolute; content: 'A'; }
-</style>
-PASS, if no exception or crash observed
-<script>
-parentDiv = document.createElement('div');
-childSpan = document.createElement('span');
-childDiv = document.createElement('div');
-textNode =  document.createTextNode('bcd');
-
-function removeTextNode() {
-    parentDiv.removeChild(textNode);
-    delete textNode;
-    if (window.layoutTestController)
-        layoutTestController.notifyDone();
-}
-
-function changeClass() {
-    parentDiv.setAttribute('class', 'inlineFL');
-    setTimeout("removeTextNode()", 10);
-}
-
-function runTest() {
-    parentDiv.setAttribute('class', 'floatFL');
-    document.documentElement.appendChild(parentDiv);
-    childSpan = document.createElement('span');
-    childSpan.setAttribute('class', 'spanStyle');
-    parentDiv.appendChild(childSpan);
-    parentDiv.appendChild(textNode);
-    childSpan.appendChild(childDiv);
-    setTimeout("changeClass()", 10);
-    if (window.layoutTestController) {
-        layoutTestController.waitUntilDone();
-        layoutTestController.dumpAsText();
-    }
-}
-window.onload = runTest;
-</script>
diff --git a/tests/tests/webkitsecurity/assets/first-letter-inline-flow-split-table-crash.html b/tests/tests/webkitsecurity/assets/first-letter-inline-flow-split-table-crash.html
deleted file mode 100755
index fa07640..0000000
--- a/tests/tests/webkitsecurity/assets/first-letter-inline-flow-split-table-crash.html
+++ /dev/null
@@ -1,47 +0,0 @@
-<style>
-.noFloat:empty { float: none; }
-.theadStyle:nth-last-child(odd) { display: table-header-group; float: right; }
-.pSpanStyle { overflow: hidden; -webkit-appearance: button; }
-.pSpanStyle:first-letter { text-align: -webkit-left; content: counter(section); }
-</style>
-<script>
-var parentSpan =  document.createElement('span');
-var childSpan =  document.createElement('span');
-var thead = document.createElement('thead');
-var textNode = document.createTextNode('abc');
-
-function removeTextNode() {
-    childSpan.removeChild(textNode);
-    delete textNode;
-    if (window.layoutTestController)
-        layoutTestController.notifyDone();
-}
-
-function changeClass() {
-    thead.setAttribute('class', 'noFloat');
-    setTimeout("removeTable()", 10);
-}
-
-function removeTable() {
-    childSpan.removeChild(thead);
-    setTimeout('removeTextNode();', 10);
-}
-
-function runTest() {
-    parentSpan.setAttribute('class', 'pSpanStyle');
-    document.documentElement.appendChild(parentSpan);
-    childSpan.setAttribute('class', 'noFloat');
-    parentSpan.appendChild(childSpan);
-    thead.setAttribute('class', 'theadStyle');
-    childSpan.appendChild(thead);
-    childSpan.appendChild(textNode);
-    setTimeout('changeClass();', 10);
-
-    if (window.layoutTestController) {
-        layoutTestController.waitUntilDone();
-        layoutTestController.dumpAsText();
-    }
-}
-window.onload = runTest;
-</script>
-PASS, if no exception or crash in debug
diff --git a/tests/tests/webkitsecurity/assets/first-letter-rtl-crash.html b/tests/tests/webkitsecurity/assets/first-letter-rtl-crash.html
deleted file mode 100644
index 8abb966..0000000
--- a/tests/tests/webkitsecurity/assets/first-letter-rtl-crash.html
+++ /dev/null
@@ -1,17 +0,0 @@
-<!DOCTYPE html>
-<html>
-<style>
-body:first-letter { color: black; }
-</style>
-<script>
-
-function run() {
-    document.execCommand('findString', false, '!ABC');
-    document.body.innerHTML = '<br>This test ensures WebKit does not crash when first-letter rule is applied to LTR letters that ' +
-    ' are not visually contiguous to each other.<br>PASS';
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-}
-
-</script>
-<body style="direction: rtl;" onload="run()">!ABC&#x202E;</body>
diff --git a/tests/tests/webkitsecurity/assets/first-letter-text-fragment-crash.html b/tests/tests/webkitsecurity/assets/first-letter-text-fragment-crash.html
deleted file mode 100644
index d9c1e75..0000000
--- a/tests/tests/webkitsecurity/assets/first-letter-text-fragment-crash.html
+++ /dev/null
@@ -1,19 +0,0 @@
-<html>
-    <style>
-        .test1:first-letter { content : ""; }
-        .test2:first-letter { text-align : center; }
-    </style>
-    <div class="test1">
-    <div class="test2">
-    PASS 
-    </div>
-    </div>
-    <script>
-        if (window.layoutTestController)
-            layoutTestController.dumpAsText();
-
-        document.execCommand("selectall");
-        document.designMode = "on";
-        document.execCommand("ForeColor", false, "red");
-    </script>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/first-letter-text-transform-causes-crash.html b/tests/tests/webkitsecurity/assets/first-letter-text-transform-causes-crash.html
deleted file mode 100644
index 6cd5640..0000000
--- a/tests/tests/webkitsecurity/assets/first-letter-text-transform-causes-crash.html
+++ /dev/null
@@ -1,40 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<style>
-       dt:first-letter{text-transform:uppercase;}
-</style>
-<script>
-
-    function buildAccessibilityTree(accessibilityObject) {
-        var count = accessibilityObject.childrenCount;
-        for (var i = 0; i < count; ++i)
-            buildAccessibilityTree(accessibilityObject.childAtIndex(i));
-    }
-</script>
-<script src="../fast/js/resources/js-test-pre.js"></script>
-</head>
-<body>
-
-<dt>dt</dt>
-
-<p id="description"></p>
-<div id="console"></div>
-
-<script>
-    description("First letter text transform causes assert and bad type cast. This can cause a crash.");
-
-    // Trigger a layout operation to create the two RenderTextFragment instances.
-    document.body.children[0].offsetWidth;
-
-    if (window.accessibilityController) {
-        // Build up full accessibility tree.
-        document.body.focus();
-        buildAccessibilityTree(accessibilityController.focusedElement);
-    }
-
-</script>
-
-<script src="../fast/js/resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/firstRect-crash-expected.png b/tests/tests/webkitsecurity/assets/firstRect-crash-expected.png
deleted file mode 100644
index b9d0d26..0000000
--- a/tests/tests/webkitsecurity/assets/firstRect-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/firstRect-crash.html b/tests/tests/webkitsecurity/assets/firstRect-crash.html
deleted file mode 100644
index 32763cb..0000000
--- a/tests/tests/webkitsecurity/assets/firstRect-crash.html
+++ /dev/null
@@ -1,20 +0,0 @@
-<body>
-<p>This test passes if we don't crash.</p>
-<h2 id='h2' class="sidebar-title">Trending:</h2>
-<p id='p'>test</p>
-<script>
-function runTest()
-{
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    window.getSelection().setBaseAndExtent(
-        document.getElementById("h2").firstChild, 9,
-        document.getElementById("p"), 0);
-    document.getElementById("p").style.display = "none";
-
-    document.getElementById("h2").innerText = "PASSED";
-}
-runTest();
-</script>
-</body>
diff --git a/tests/tests/webkitsecurity/assets/firstletter-tablecell-crash.html b/tests/tests/webkitsecurity/assets/firstletter-tablecell-crash.html
deleted file mode 100644
index bacd464..0000000
--- a/tests/tests/webkitsecurity/assets/firstletter-tablecell-crash.html
+++ /dev/null
@@ -1,7 +0,0 @@
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
-<style>*:nth-child(2):first-letter { vertical-align: super; }</style>
-<a>...</a><del style="display:table-cell;">This text should be displayed without crashing
-
diff --git a/tests/tests/webkitsecurity/assets/firstline-fixed-crash.html b/tests/tests/webkitsecurity/assets/firstline-fixed-crash.html
deleted file mode 100644
index 6f95149..0000000
--- a/tests/tests/webkitsecurity/assets/firstline-fixed-crash.html
+++ /dev/null
@@ -1,11 +0,0 @@
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
-<style>
-*:nth-child(2):first-line { margin-bottom: 1px; }</style>
-<div contentEditable>
-<a style="position: fixed;">
-This text should render without crashing
-</div>...
-
diff --git a/tests/tests/webkitsecurity/assets/fix-range-from-root-editable-crash.html b/tests/tests/webkitsecurity/assets/fix-range-from-root-editable-crash.html
deleted file mode 100644
index 635f6fd..0000000
--- a/tests/tests/webkitsecurity/assets/fix-range-from-root-editable-crash.html
+++ /dev/null
@@ -1,20 +0,0 @@
-<html>
-<head>
-<script>
-
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-}
-
-function go() {
-    document.designMode = "on";
-    document.execCommand("SelectAll",         false, null);
-    document.execCommand("strikethrough",     false, null);
-    document.body.innerHTML = 'This tests ApplyStyleCommand::fixRangeAndApplyInlineStyle does not crash when startNode is body.<br>PASS';
-    layoutTestController.notifyDone();
-}
-</script>
-</head>
-<body onload="go()"><div><img></div></body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/fixed-table-layout-large-colspan-crash.html b/tests/tests/webkitsecurity/assets/fixed-table-layout-large-colspan-crash.html
deleted file mode 100644
index 855dd85..0000000
--- a/tests/tests/webkitsecurity/assets/fixed-table-layout-large-colspan-crash.html
+++ /dev/null
@@ -1,26 +0,0 @@
-<html>
-<head>
-<style type="text/css">
-table {
-    table-layout: fixed;
-    width: 15px;
-}
-</style>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function finish() {
-    document.getElementById("result").innerHTML = "PASS";
-}
-</script>
-</head>
-<body onload="finish()">
-<p>Tests that large colspan in a fixed table layout does not result in crash.</p>
-<div id=result></div>
-<table>
-<td colspan="1923138113">
-</td>
-</table>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/flexbox-in-region-crash.html b/tests/tests/webkitsecurity/assets/flexbox-in-region-crash.html
deleted file mode 100644
index 8a79a90..0000000
--- a/tests/tests/webkitsecurity/assets/flexbox-in-region-crash.html
+++ /dev/null
@@ -1,51 +0,0 @@
-<!doctype html>
-<html>
-    <head>
-        <style>
-            #el1 {
-                -webkit-flow-into: A;
-                display: -webkit-flexbox;
-            }
-            #el3 {
-                -webkit-flow-from: A;
-            }
-        </style>
-        <script>
-            if (window.layoutTestController) {
-                layoutTestController.dumpAsText();
-                layoutTestController.waitUntilDone();
-            }
-
-            onload = function() {
-                el1 = document.createElement('div')
-                el1.setAttribute('id','el1')
-                document.body.appendChild(el1)
-
-                el2 = document.createElement('div')
-                document.body.appendChild(el2)
-
-                el3 = document.createElement('hr')
-                el3.setAttribute('id','el3')
-                el2.appendChild(el3)
-
-                el4 = document.createElement('p')
-                el4.setAttribute('id', 'el4')
-                el5 = document.createTextNode("P1")
-                el4.appendChild(el5)
-                el1.appendChild(el4)
-
-                setTimeout(function() {
-                    el1.style.display='inline'
-                    el4.style.visibility = 'hidden'
-
-                    if (window.layoutTestController)
-                        layoutTestController.notifyDone();
-	            },0)
-            }
-        </script>
-    </head>
-    <body>
-        <p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=77474">77474</a>: Crash in RenderFlowThread::setRegionBoxesRegionStyle</p>
-        <p> This test PASSES if it does not CRASH or ASSERT.</p>
-    </body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/float-not-removed-crash.html b/tests/tests/webkitsecurity/assets/float-not-removed-crash.html
deleted file mode 100644
index 82e76ba..0000000
--- a/tests/tests/webkitsecurity/assets/float-not-removed-crash.html
+++ /dev/null
@@ -1,26 +0,0 @@
-<html>

-    Test passes if it does not crash.

-    <body onload="runTest()">

-        <div style="display: -webkit-inline-box">

-            <span id="span1">

-                <span><blockquote></blockquote></span>

-                <span><p style="float: left;"></p></span>

-            </span>

-            <span id="span2" style="display: list-item"></span>

-        </div>

-        <script type="text/javascript">

-            if (window.layoutTestController)

-                layoutTestController.dumpAsText();

-

-            function runTest() {

-                document.body.offsetTop;

-                span1 = document.getElementById('span1');

-                span2 = document.getElementById('span2');

-                tfoot = document.createElement('tfoot');

-                span2.appendChild(tfoot);

-                document.body.offsetTop;

-                span1.parentNode.removeChild(span1);

-            }

-        </script>

-    </body>

-</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/float-not-removed-from-next-sibling-crash.html b/tests/tests/webkitsecurity/assets/float-not-removed-from-next-sibling-crash.html
deleted file mode 100644
index e7aa0b8..0000000
--- a/tests/tests/webkitsecurity/assets/float-not-removed-from-next-sibling-crash.html
+++ /dev/null
@@ -1,32 +0,0 @@
-<html>

-    <body onload="runTest()">

-        Test passes if it does not crash.

-        <div style="width: 15px;">

-            <script>

-                if (window.layoutTestController)

-                    layoutTestController.dumpAsText();

-

-                function runTest()

-                {

-                    document.body.offsetTop;

-                    var container = document.getElementById('panel');

-                    container.style.position = 'relative';

-                    document.getElementById('test1').style.position = 'absolute';

-                    document.getElementById('test2').style.position = 'absolute';

-                    document.body.offsetTop;

-                    

-                    container.style.height = '1px';

-                    document.getElementById('test1').style.display = 'none';

-                }

-            </script>

-            <div id="panel">

-                <div id="test1">

-                    <img style="float: left" height="1px">

-                </div>

-                <div id="test2">

-                    <a><p>P A S S</p>

-                </div>

-            </div>

-        </div>

-    </body>

-</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/float-originating-line-deleted-crash.html b/tests/tests/webkitsecurity/assets/float-originating-line-deleted-crash.html
deleted file mode 100644
index cce2564..0000000
--- a/tests/tests/webkitsecurity/assets/float-originating-line-deleted-crash.html
+++ /dev/null
@@ -1,26 +0,0 @@
-<html>

-Test passes if it does not crash.

-<script>

-if (window.layoutTestController) {

-    layoutTestController.dumpAsText();

-    layoutTestController.waitUntilDone();

-}

-

-function runTest()

-{

-    child = document.getElementById('test');

-    child.parentNode.removeChild(child);

-

-	document.body.offsetTop;

-    

-    if (window.layoutTestController)

-        layoutTestController.notifyDone();

-}

-

-setTimeout("runTest();", 0);

-</script>

-<style id='test'>

-    p { float: left; }

-</style>

-<table><span><p></p><p></p></span></table>

-</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/floating-before-content-with-list-marker-crash.html b/tests/tests/webkitsecurity/assets/floating-before-content-with-list-marker-crash.html
deleted file mode 100644
index 2c665d7..0000000
--- a/tests/tests/webkitsecurity/assets/floating-before-content-with-list-marker-crash.html
+++ /dev/null
@@ -1,19 +0,0 @@
-<style>
-.floatingBefore::before { overflow: visible; float: left; content: open-quote; }
-</style>
-<script>
-tbodyElement = document.createElement('tbody');
-listItemElement = document.createElement('li');
-listItemElement.setAttribute('class', 'floatingBefore');
-document.documentElement.appendChild(listItemElement);
-headerElement = document.createElement('header');
-listItemElement.appendChild(headerElement);
-listItemElement.appendChild(document.createElement('sub'));
-document.documentElement.offsetHeight;
-tbodyElement.appendChild(headerElement);
-
-document.documentElement.appendChild(document.createTextNode('PASS if no crash or assert in debug'));
-
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
diff --git a/tests/tests/webkitsecurity/assets/floats-not-cleared-crash.html b/tests/tests/webkitsecurity/assets/floats-not-cleared-crash.html
deleted file mode 100644
index f72159d..0000000
--- a/tests/tests/webkitsecurity/assets/floats-not-cleared-crash.html
+++ /dev/null
@@ -1,26 +0,0 @@
-<html>

-<script>

-if (window.layoutTestController)

-{

-    layoutTestController.dumpAsText();

-    layoutTestController.waitUntilDone();

-}   

-window.setTimeout('crash();', 0);

-function crash()

-{

-    document.body.offsetTop;

-

-    block1.style.position = 'absolute';

-    float1.style.display = 'none';

-

-    document.body.offsetTop;

-    block1.innerHTML = "PASS";

-    if (window.layoutTestController)

-        layoutTestController.notifyDone();

-}

-</script>

-<div id="block1">

-<span id="float1" style="float: left; margin-bottom: 10000px;">

-</div>

-<junk>

-<html>

diff --git a/tests/tests/webkitsecurity/assets/focus-change-crash.html b/tests/tests/webkitsecurity/assets/focus-change-crash.html
deleted file mode 100644
index 9b28155..0000000
--- a/tests/tests/webkitsecurity/assets/focus-change-crash.html
+++ /dev/null
@@ -1,27 +0,0 @@
-<div>Type something into the first input and press tab.  The browser should not crash.</div>
-<div id="parent">
-<input id="a" />
-<input id="b" />
-</div>
-<div id="results"></div>
-<script>
-document.getElementById("a").addEventListener("change", function(e) {
-    var parent = document.getElementById("parent");
-    parent.innerHTML = "<input id='c' />";
-    document.getElementById("c").select();
-}, false);
-
-function runTest()
-{
-    document.getElementById("a").focus();
-    if (!window.layoutTestController)
-        return;
-    layoutTestController.dumpAsText();
-    eventSender.keyDown("x")
-    eventSender.keyDown("\t");
-    document.getElementById("results").innerText = "PASSED";
-}
-
-runTest();
-
-</script>
diff --git a/tests/tests/webkitsecurity/assets/focus-change-crash2.html b/tests/tests/webkitsecurity/assets/focus-change-crash2.html
deleted file mode 100644
index 7800465..0000000
--- a/tests/tests/webkitsecurity/assets/focus-change-crash2.html
+++ /dev/null
@@ -1,31 +0,0 @@
-<p>This tests a crash when changing focus deletes the node being focused. This test requires DRT.</p>
-<div id='test'><input id='1' /><input id='2' /></div>
-<script>
-function runTest()
-{
-    document.getElementById("1").addEventListener("keypress", function(e) {
-        document.getElementById("2").focus();
-
-        setTimeout(function() {
-            document.getElementById("test").innerHTML = "PASSED";
-            layoutTestController.notifyDone();
-        }, 0);
-    }, false);
-
-    document.getElementById("1").addEventListener("change", function(e) {
-        document.getElementById("test").innerHTML = "<input id='3' />";
-        window.GCController.collect();
-        document.getElementById("3").focus();
-    }, false);
-
-    document.getElementById("1").focus();
-
-    if (window.layoutTestController) {
-        layoutTestController.dumpAsText();
-        layoutTestController.waitUntilDone();
-        eventSender.keyDown("a")
-    }
-}
-
-runTest();
-</script>
diff --git a/tests/tests/webkitsecurity/assets/focus-controller-crash-change-event.html b/tests/tests/webkitsecurity/assets/focus-controller-crash-change-event.html
deleted file mode 100644
index 126f0e6..0000000
--- a/tests/tests/webkitsecurity/assets/focus-controller-crash-change-event.html
+++ /dev/null
@@ -1,32 +0,0 @@
-<html>

-<div id="b">

-    Press a key!

-    <input id="a">

-    <iframe></iframe>

-</div>

-<script>

-if (window.layoutTestController) {

-    layoutTestController.dumpAsText();

-	layoutTestController.waitUntilDone();

-}

-

-a.addEventListener("change", function() { 

-    b.innerHTML = "PASS";

-

-	if (window.layoutTestController)

-	    layoutTestController.notifyDone();

-});

-

-a.addEventListener("keyup", function() {

-    var e = document.createEvent("KeyboardEvent");

-    e.initKeyboardEvent('keydown', true, true, document.defaultView, 'U+0009', 0, false, false, false, false, false);

-    a.dispatchEvent(e);

-})

-

-document.body.offsetTop;

-a.focus();

-

-if (window.layoutTestController)

-    eventSender.keyDown('a');

-</script>

-</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/focus-crash-expected.png b/tests/tests/webkitsecurity/assets/focus-crash-expected.png
deleted file mode 100644
index c666229..0000000
--- a/tests/tests/webkitsecurity/assets/focus-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/focus-crash.html b/tests/tests/webkitsecurity/assets/focus-crash.html
deleted file mode 100644
index b0cb936..0000000
--- a/tests/tests/webkitsecurity/assets/focus-crash.html
+++ /dev/null
@@ -1,44 +0,0 @@
-<html><head>
-<title>Focus crash</title>
-</head>
-<body onload="load()">
-To run this test manually, click the "Crash me" button.
-<div id='container'>
-    <iframe id='testframe' style="width: 100%; height:200px;" src="../resources/iframebody.html"></iframe>
-</div>
-<input id='testbutton' type="button" value="Crash me" onclick="crash()">
-<ul id="console"></ul>
-<script>
-
-function load()
-{
-    document.getElementById('testframe').contentWindow.document.body.focus();
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    if (eventSender) {
-        var button = document.getElementById('testbutton');
-        eventSender.mouseMoveTo(button.offsetLeft + 10, button.offsetTop + 5)
-        eventSender.mouseDown();
-        eventSender.mouseUp();
-    }
-}
-
-function crash()
-{
-    var focuselem = document.getElementById('testframe').contentWindow;
-    var elem = document.getElementById('container');
-    elem.style.display = 'none';
-    focuselem.focus();
-    log("SUCCEEDED");
-}
-
-function log(str) {
-    var li = document.createElement("li");
-    li.appendChild(document.createTextNode(str));
-    var console = document.getElementById("console");
-    console.appendChild(li);
-}
-</script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/font-platformDestroy-crash-expected.png b/tests/tests/webkitsecurity/assets/font-platformDestroy-crash-expected.png
deleted file mode 100644
index 832067e..0000000
--- a/tests/tests/webkitsecurity/assets/font-platformDestroy-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/font-platformDestroy-crash.svg b/tests/tests/webkitsecurity/assets/font-platformDestroy-crash.svg
deleted file mode 100644
index 42538d2..0000000
--- a/tests/tests/webkitsecurity/assets/font-platformDestroy-crash.svg
+++ /dev/null
@@ -1,37 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1 Tiny//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11-tiny.dtd">
-
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" id="svg-root" width="100%" height="100%" viewBox="0 0 480 360">
-    <style id="style">
-        text { }
-    </style>
-    <g id="test-body-content" font-size="10">
-        <defs>
-        <font id="embeded" horiz-adv-x="224">
-<font-face font-family="embeded" units-per-em="1000" panose-1="0 0 0 0 0 0 0 0 0 0" ascent="917" descent="-250" alphabetic="0"/>
-            <glyph unicode="1" glyph-name="gl_1" horiz-adv-x="1500" d="M 0 0 L 250 0 L 250 250 L 0 250 Z"/>
-        </font>
-        </defs>
-
-        <g transform="translate(100, 40)">
-            <text font-family="embeded">1</text>
-        </g>
-        <g transform="translate(100, 60)">
-            <text>Test for http://bugs.webkit.org/show_bug.cgi?id=16967</text>
-        </g>
-    </g>
-
-    <script><![CDATA[
-        if (window.layoutTestController)
-            layoutTestController.dumpAsText();
-
-        var style = document.getElementById("style");
-        var parent = style.parentNode;
-
-        for (var t = 0; t < 50; t++) {
-            parent.offsetTop;
-            parent.removeChild(style);
-            parent.appendChild(style);
-        }
-    ]]></script>
-</svg>
diff --git a/tests/tests/webkitsecurity/assets/fontMetric-border-radius-null-crash.html b/tests/tests/webkitsecurity/assets/fontMetric-border-radius-null-crash.html
deleted file mode 100644
index 4065439..0000000
--- a/tests/tests/webkitsecurity/assets/fontMetric-border-radius-null-crash.html
+++ /dev/null
@@ -1,8 +0,0 @@
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-    document.writeln("<v>");
-    document.body.innerHTML="<style>*{border-radius:5ex;}</style>";
-    document.write("<title>x");
-    document.body.innerHTML = "<a href='https://bugs.webkit.org/show_bug.cgi?id=57756'>chrome.dll!WebCore::RenderStyle::fontMetrics ReadAV@NULL (two crashes)<br>PASSED: This test did not crash!";
-</script>
diff --git a/tests/tests/webkitsecurity/assets/fontMetric-webkit-border-end-width-null-crash.html b/tests/tests/webkitsecurity/assets/fontMetric-webkit-border-end-width-null-crash.html
deleted file mode 100644
index d127f02..0000000
--- a/tests/tests/webkitsecurity/assets/fontMetric-webkit-border-end-width-null-crash.html
+++ /dev/null
@@ -1,8 +0,0 @@
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-    document.writeln("<v>");
-    document.body.innerHTML="<style>*{-webkit-border-end-width:0ex;}</style>";
-    document.write("<title>x");
-    document.body.innerHTML = "<a href='https://bugs.webkit.org/show_bug.cgi?id=57756'>chrome.dll!WebCore::RenderStyle::fontMetrics ReadAV@NULL (two crashes)<br>PASSED: This test did not crash!";
-</script>
diff --git a/tests/tests/webkitsecurity/assets/fontsize-unit-rems-crash.html b/tests/tests/webkitsecurity/assets/fontsize-unit-rems-crash.html
deleted file mode 100644
index 4d3d16f..0000000
--- a/tests/tests/webkitsecurity/assets/fontsize-unit-rems-crash.html
+++ /dev/null
@@ -1,7 +0,0 @@
-<html style="display:none;">
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
-<title style="line-height: 1rem;">Test case for 61989</title>
-<p>This is test for Bug 61989 No crash means test PASS.</p></html>
diff --git a/tests/tests/webkitsecurity/assets/foreign-content-crash.html b/tests/tests/webkitsecurity/assets/foreign-content-crash.html
deleted file mode 100644
index 718981a..0000000
--- a/tests/tests/webkitsecurity/assets/foreign-content-crash.html
+++ /dev/null
@@ -1,8 +0,0 @@
-<script>
-    var svgElement = document.createElementNS("http://www.w3.org/2000/svg", "svg");
-    svgElement.appendChild(document.createElement("div")).insertAdjacentHTML("beforeBegin", "</p>");
-
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-<p>This test passes if it doesn't crash.</p>
diff --git a/tests/tests/webkitsecurity/assets/foreignObject-crash-on-hover-expected.png b/tests/tests/webkitsecurity/assets/foreignObject-crash-on-hover-expected.png
deleted file mode 100644
index 5f7999f..0000000
--- a/tests/tests/webkitsecurity/assets/foreignObject-crash-on-hover-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/foreignObject-crash-on-hover.xml b/tests/tests/webkitsecurity/assets/foreignObject-crash-on-hover.xml
deleted file mode 100644
index e4479df..0000000
--- a/tests/tests/webkitsecurity/assets/foreignObject-crash-on-hover.xml
+++ /dev/null
@@ -1,32 +0,0 @@
-<?xml version="1.0"?>
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
-         "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
-<svg xmlns="http://www.w3.org/2000/svg"
-     xmlns:xlink="http://www.w3.org/1999/xlink"
-     xmlns:html="http://www.w3.org/1999/xhtml"
-     height="600" width="800" onload="runRepaintTest()">
-  <script xlink:href="../../fast/repaint/resources/repaint.js"/>
-  <g transform="translate(50,50)">
-    <polygon points="0,0 300,0 300,300 0,300" style="fill:lightblue; stroke:red;"/>
-    <!-- switch -->
-    <foreignObject x="10" y="10" width="280" height="280">
-      <html:b>Absolute Lineto</html:b><html:br/>
-       &lt;path d="M50,80 L250,80 150,280 z" 
-                style="fill:red; stroke:blue;"/&gt;
-    </foreignObject>
-    <!-- /switch -->
-    <path d="M50,80 L250,80 150,280 z" 
-          style="fill:red; stroke:blue;"/>
-  </g>
-  <script>
-  function repaintTest() {
-    if (window.eventSender) {
-        layoutTestController.waitUntilDone();
-        eventSender.mouseMoveTo(100, 100);
-        eventSender.mouseUp();
-        eventSender.mouseDown();
-        setTimeout("layoutTestController.notifyDone()", 0);
-    }
-  }
-  </script>
-</svg> 
diff --git a/tests/tests/webkitsecurity/assets/foreignobject-crash-with-absolute-positioned-children.svg b/tests/tests/webkitsecurity/assets/foreignobject-crash-with-absolute-positioned-children.svg
deleted file mode 100644
index 68d1e47..0000000
--- a/tests/tests/webkitsecurity/assets/foreignobject-crash-with-absolute-positioned-children.svg
+++ /dev/null
@@ -1,12 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg">
-<script>
-  if (window.layoutTestController)
-     layoutTestController.dumpAsText();
-</script>
-
-    <foreignObject  width="100%" height="100%" >
-        <body xmlns="http://www.w3.org/1999/xhtml" >
-            <div style="position:absolute">PASS -- This did not crash. https://bugs.webkit.org/show_bug.cgi?id=26342</div>
-        </body>
-    </foreignObject>
-</svg>
diff --git a/tests/tests/webkitsecurity/assets/form-associated-element-crash.html b/tests/tests/webkitsecurity/assets/form-associated-element-crash.html
deleted file mode 100644
index 80aae53..0000000
--- a/tests/tests/webkitsecurity/assets/form-associated-element-crash.html
+++ /dev/null
@@ -1,45 +0,0 @@
-<html>
-<head>
-<script>
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-}
-
-if (!window.gc) {
-    gc = function () {
-        if (window.GCController)
-            return GCController.collect();
-        for (var i = 0; i < 10000; i++)
-            var s = new String("abc");
-    }
-}
-
-var element = document.createElement('input');
-
-function test() {
-    element.setAttribute('form', 'form1');
-    document.body.appendChild(element);
-    element.attributes.removeNamedItem('form');
-    setTimeout(delay, 0);
-}
-
-function delay() {
-    document.body.removeChild(element);
-    element = 0;
-    gc();
-    var form = document.createElement('form');
-    form.setAttribute('id', 'form2');
-    document.body.appendChild(form);
-    if (window.layoutTestController)
-        layoutTestController.notifyDone();
-}
-</script>
-</head>
-<body onload="test()">
-<p>
-This page is a test case for <a href="https://bugs.webkit.org/show_bug.cgi?id=51905">Bug 51905</a>. WebKit should not crash when this page is loaded.
-</p>
-PASS
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/form-associated-element-crash2.html b/tests/tests/webkitsecurity/assets/form-associated-element-crash2.html
deleted file mode 100644
index 2030306..0000000
--- a/tests/tests/webkitsecurity/assets/form-associated-element-crash2.html
+++ /dev/null
@@ -1,48 +0,0 @@
-<html>
-<head>
-<script>
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-}
-
-function gc() {
-    var array = [];
-    for (var i = 0x30000; i--; )
-        if (!(Math.round(Math.random() * 20)))
-            array = [];
-        else
-            array.push(new String(Math.random()))
-}
-
-function test()
-{
-    var element = document.createElement('input');
-    element.setAttribute('form', 'form1');
-    var div = document.createElement('div');
-    div.appendChild(element);
-    element.removeAttribute('form');
-    div.innerHTML = '';
-    element = 0;
-    gc();
-    setTimeout(delay, 0);
-}
-
-function delay()
-{
-    var form = document.createElement('form');
-    form.setAttribute('id', 'form2');
-    document.body.appendChild(form);
-    location.reload();
-    if (window.layoutTestController)
-        layoutTestController.notifyDone();
-}
-</script>
-</head>
-<body onload="test()">
-<p>
-This page is a test case for <a href="https://bugs.webkit.org/show_bug.cgi?id=51905">Bug 51905</a>. WebKit should not crash when this page is loaded.
-</p>
-PASS
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/form-associated-element-crash3.html b/tests/tests/webkitsecurity/assets/form-associated-element-crash3.html
deleted file mode 100644
index 033ffff..0000000
--- a/tests/tests/webkitsecurity/assets/form-associated-element-crash3.html
+++ /dev/null
@@ -1,16 +0,0 @@
-<body>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
-This test passes if it doesn't crash.  Note: You might need to reload this test
-many times (or run the test under valgrind / ASAN) to see a crash.
-<span>
-<span>
-<video src="javascript:" onloadstart>
-<form  id="tjbvp"></form>
-</video>
-</span>
-</span>
-<keygen form="woujt">
-</body>
diff --git a/tests/tests/webkitsecurity/assets/form-iframe-target-before-load-crash.html b/tests/tests/webkitsecurity/assets/form-iframe-target-before-load-crash.html
deleted file mode 100644
index 87ff1f6..0000000
--- a/tests/tests/webkitsecurity/assets/form-iframe-target-before-load-crash.html
+++ /dev/null
@@ -1,37 +0,0 @@
-<html>

-    <script src="../js/resources/js-test-pre.js"></script>

-    <body onload="runTest()">

-        <div id="console"></div>

-        <form id="form1" style="display:none" method="post" target="test" action="http://anything.com"></form>

-        <script>

-            if (window.layoutTestController)

-            {

-                layoutTestController.dumpAsText();

-                layoutTestController.waitUntilDone();

-            }

-        

-            function runTest()

-            {

-                document.getElementById('form1').submit();

-                

-                if (window.layoutTestController)

-                    layoutTestController.notifyDone();

-                document.getElementById('console').innerHTML = 'PASS';

-            }

-

-            count = 0;

-            document.addEventListener("beforeload", function(event) {

-                event.preventDefault();

-                count = count + 1;

-                if (count == 2)

-                {

-                    document.body.removeChild(document.getElementById('test'));

-                    gc();

-                    document.body.offsetTop;

-                }

-            }, true);

-       </script>

-       <iframe id="test" src="about:blank"></iframe>

-   </body>

-</html>

-

diff --git a/tests/tests/webkitsecurity/assets/form-iframe-target-before-load-crash2.html b/tests/tests/webkitsecurity/assets/form-iframe-target-before-load-crash2.html
deleted file mode 100644
index e5fa9da..0000000
--- a/tests/tests/webkitsecurity/assets/form-iframe-target-before-load-crash2.html
+++ /dev/null
@@ -1,37 +0,0 @@
-<html>

-    <script src="../js/resources/js-test-pre.js"></script>

-    <body onload="runTest()">

-        <div id="console"></div>

-        <form id="form1" style="display:none" target="test" action="about:blank"></form>

-        <script>

-            if (window.layoutTestController)

-            {

-                layoutTestController.dumpAsText();

-                layoutTestController.waitUntilDone();

-            }

-        

-            function runTest()

-            {

-                document.getElementById('form1').submit();

-                

-                if (window.layoutTestController)

-                    layoutTestController.notifyDone();

-                document.getElementById('console').innerHTML = 'PASS';

-            }

-

-            count = 0;

-            document.addEventListener("beforeload", function(event) {

-                event.preventDefault();

-                count = count + 1;

-                if (count == 2)

-                {

-                    document.body.removeChild(document.getElementById('test'));

-                    gc();

-                    document.body.offsetTop;

-                }

-            }, true);

-       </script>

-       <iframe id="test" src="about:blank"></iframe>

-   </body>

-</html>

-

diff --git a/tests/tests/webkitsecurity/assets/form-in-row-before-misnested-text-crash-css.html b/tests/tests/webkitsecurity/assets/form-in-row-before-misnested-text-crash-css.html
deleted file mode 100644
index 9a8e524..0000000
--- a/tests/tests/webkitsecurity/assets/form-in-row-before-misnested-text-crash-css.html
+++ /dev/null
@@ -1,55 +0,0 @@
-<html>
-<head>
-<script type="text/javascript">
-
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function boom()
-{
-  var tr = document.getElementById("tr1");
-  var xxx = document.getElementById("tr1").firstChild;
-
-  tr.insertBefore(document.createTextNode("0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99"), xxx);
-
-  tr.insertBefore(document.getElementById("f1").cloneNode(true), xxx);
-}
-
-
-
-</script>
-<style>
-.table {
-    display: table;
-}
-
-.tbody {
-    display: table-row-group;
-}
-
-.tr {
-    display: table-row;
-}
-
-.td {
-    display: table-cell;
-}
-
-</style>
-</head>
-
-<body onload="boom()">
-
-<div>This test checks whether a particular odd arrangement of DOM
-nodes results in render tree consistency violations.</div>
-
-<div class="table" border="1">
- <div class="tr" id="tr1"> xxx
-  <div class="td">Whee</div>
- </div>
-</div>
-
-<form id="f1">QQQ</form>
-
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/form-in-row-before-misnested-text-crash.xhtml b/tests/tests/webkitsecurity/assets/form-in-row-before-misnested-text-crash.xhtml
deleted file mode 100644
index 8a16723..0000000
--- a/tests/tests/webkitsecurity/assets/form-in-row-before-misnested-text-crash.xhtml
+++ /dev/null
@@ -1,37 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-<script type="text/javascript">
-
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function boom()
-{
-  var tr = document.getElementById("tr1");
-  var xxx = document.getElementById("tr1").firstChild;
-
-  tr.insertBefore(document.createTextNode("0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99"), xxx);
-
-  tr.insertBefore(document.getElementById("f1").cloneNode(true), xxx);
-}
-
-
-
-</script>
-</head>
-
-<body onload="boom()">
-
-<div>This test checks whether a particular odd arrangement of DOM
-nodes results in render tree consistency violations.</div>
-
-<table border="1">
- <tr id="tr1"> xxx
-  <td>Whee</td>
- </tr>
-</table>
-
-<form id="f1">QQQ</form>
-
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/form-in-table-before-misnested-text-crash-css.html b/tests/tests/webkitsecurity/assets/form-in-table-before-misnested-text-crash-css.html
deleted file mode 100644
index f9699ef..0000000
--- a/tests/tests/webkitsecurity/assets/form-in-table-before-misnested-text-crash-css.html
+++ /dev/null
@@ -1,55 +0,0 @@
-<html>
-<head>
-<script type="text/javascript">
-
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function boom()
-{
-  var tr = document.getElementById("tr1");
-  var xxx = document.getElementById("tr1").firstChild;
-
-  tr.insertBefore(document.createTextNode("0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99"), xxx);
-
-  tr.insertBefore(document.getElementById("f1").cloneNode(true), xxx);
-}
-</script>
-<style>
-.table {
-    display: table;
-}
-
-.tbody {
-    display: table-row-group;
-}
-
-.tr {
-    display: table-row;
-}
-
-.td {
-    display: table-cell;
-}
-
-</style>
-</head>
-
-<div>This test checks whether a particular odd arrangement of DOM
-nodes results in render tree consistency violations.</div>
-
-<body onload="boom()">
-
-<div class="table" border="1" id="tr1">
- xxx
-<div class="tbody">
- <div class="tr">
-  <div class="td">Whee</div>
- </div>
-</div>
-</div>
-
-<form id="f1">QQQ</form>
-
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/form-in-table-before-misnested-text-crash.xhtml b/tests/tests/webkitsecurity/assets/form-in-table-before-misnested-text-crash.xhtml
deleted file mode 100644
index 1ff6b81..0000000
--- a/tests/tests/webkitsecurity/assets/form-in-table-before-misnested-text-crash.xhtml
+++ /dev/null
@@ -1,40 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-<script type="text/javascript">
-
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function boom()
-{
-  var tr = document.getElementById("tr1");
-  var xxx = document.getElementById("tr1").firstChild;
-
-  tr.insertBefore(document.createTextNode("0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99"), xxx);
-
-  tr.insertBefore(document.getElementById("f1").cloneNode(true), xxx);
-}
-
-
-
-</script>
-</head>
-
-<div>This test checks whether a particular odd arrangement of DOM
-nodes results in render tree consistency violations.</div>
-
-<body onload="boom()">
-
-<table border="1" id="tr1">
- xxx
-<tbody>
- <tr>
-  <td>Whee</td>
- </tr>
-</tbody>
-</table>
-
-<form id="f1">QQQ</form>
-
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/form-in-tbody-before-misnested-text-crash-css.html b/tests/tests/webkitsecurity/assets/form-in-tbody-before-misnested-text-crash-css.html
deleted file mode 100644
index b1ec421..0000000
--- a/tests/tests/webkitsecurity/assets/form-in-tbody-before-misnested-text-crash-css.html
+++ /dev/null
@@ -1,54 +0,0 @@
-<html>
-<head>
-<script type="text/javascript">
-
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function boom()
-{
-  var tr = document.getElementById("tr1");
-  var xxx = document.getElementById("tr1").firstChild;
-
-  tr.insertBefore(document.createTextNode("0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99"), xxx);
-
-  tr.insertBefore(document.getElementById("f1").cloneNode(true), xxx);
-}
-</script>
-<style>
-.table {
-    display: table;
-}
-
-.tbody {
-    display: table-row-group;
-}
-
-.tr {
-    display: table-row;
-}
-
-.td {
-    display: table-cell;
-}
-
-</style>
-</head>
-
-<div>This test checks whether a particular odd arrangement of DOM
-nodes results in render tree consistency violations.</div>
-
-<body onload="boom()">
-
-<div class="table" border="1">
-<div class="tbody" id="tr1"> xxx
- <div class="tr">
-  <div class="td">Whee</div>
- </div>
-</div>
-</div>
-
-<form id="f1">QQQ</form>
-
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/form-in-tbody-before-misnested-text-crash.xhtml b/tests/tests/webkitsecurity/assets/form-in-tbody-before-misnested-text-crash.xhtml
deleted file mode 100644
index 436eb79..0000000
--- a/tests/tests/webkitsecurity/assets/form-in-tbody-before-misnested-text-crash.xhtml
+++ /dev/null
@@ -1,39 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-<script type="text/javascript">
-
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function boom()
-{
-  var tr = document.getElementById("tr1");
-  var xxx = document.getElementById("tr1").firstChild;
-
-  tr.insertBefore(document.createTextNode("0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99"), xxx);
-
-  tr.insertBefore(document.getElementById("f1").cloneNode(true), xxx);
-}
-
-
-
-</script>
-</head>
-
-<div>This test checks whether a particular odd arrangement of DOM
-nodes results in render tree consistency violations.</div>
-
-<body onload="boom()">
-
-<table border="1">
-<tbody id="tr1"> xxx
- <tr>
-  <td>Whee</td>
- </tr>
-</tbody>
-</table>
-
-<form id="f1">QQQ</form>
-
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/form-submission-create-crash.xhtml b/tests/tests/webkitsecurity/assets/form-submission-create-crash.xhtml
deleted file mode 100644
index 5947a2f..0000000
--- a/tests/tests/webkitsecurity/assets/form-submission-create-crash.xhtml
+++ /dev/null
@@ -1,25 +0,0 @@
-<html xmlns='http://www.w3.org/1999/xhtml'>
-Test passes if it does not crash.
-<form>
-<input id="submit" type="submit" />
-</form>
-<script>
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-}
-
-textNode = document.createTextNode("x");
-document.getElementById("submit").appendChild(textNode);
-
-runTest = function() {
-    event = document.createEvent("MouseEvent");
-    event.initEvent("click");
-    textNode.dispatchEvent(event);
-    if (window.layoutTestController)
-        layoutTestController.notifyDone();
-}
-
-setTimeout(runTest, 0);
-</script>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/frame-contentWindow-crash.html b/tests/tests/webkitsecurity/assets/frame-contentWindow-crash.html
deleted file mode 100644
index 18b031b..0000000
--- a/tests/tests/webkitsecurity/assets/frame-contentWindow-crash.html
+++ /dev/null
@@ -1,12 +0,0 @@
-This is a test for <a href="http://bugs.webkit.org/show_bug.cgi?id=13868">http://bugs.webkit.org/show_bug.cgi?id=13868</a> 
-REGRESSION: crash on accessing a new iframe's contentWindow property.
-
-This tests HTMLFrameElement.contentWindow.
-
-If there is no crash this test passes.
-<script type="text/javascript">
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    document.createElement('frame').contentWindow;
-</script>
diff --git a/tests/tests/webkitsecurity/assets/frame-crash-with-page-cache.html b/tests/tests/webkitsecurity/assets/frame-crash-with-page-cache.html
deleted file mode 100644
index 3621f24..0000000
--- a/tests/tests/webkitsecurity/assets/frame-crash-with-page-cache.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<html>
-<script>
-window.finish = function()
-{
-    if (layoutTestController)
-        layoutTestController.notifyDone();
-}
-
-window.log = function(message) {
-     document.getElementById("result").innerHTML += message + "<br>";
-}
-
-window.failure = function(message) {
-    log("FAIL: " + message);
-    finish();
-}
-
-function test() {
-    if (window.layoutTestController) {
-        layoutTestController.dumpAsText();
-        layoutTestController.waitUntilDone();
-        layoutTestController.setCanOpenWindows();
-        layoutTestController.overridePreference("WebKitUsesPageCachePreferenceKey", 1);
-    }
-    log("open page-1");
-    window.open("resources/cached-page-1.html");
-}
-</script>
-
-<body onload="test()">
-If WebKit does not assert or crash, you passed.
-<div id="result"></div>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/frame-unload-abort-crash.html b/tests/tests/webkitsecurity/assets/frame-unload-abort-crash.html
deleted file mode 100644
index ca2407c..0000000
--- a/tests/tests/webkitsecurity/assets/frame-unload-abort-crash.html
+++ /dev/null
@@ -1,42 +0,0 @@
-<html>
-<body>
-<p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=25394">bug 25394</a>: crash in DocumentLoader::addResponse due to bad |this| pointer</p>
-<p>You should see a few messages followed by PASSED once. </p>
-<script>
-    var consoleMessages = document.createElement("ul");
-    document.body.appendChild(consoleMessages);
-
-    if (window.layoutTestController) {
-        layoutTestController.waitUntilDone();
-        layoutTestController.dumpAsText();
-    }
-
-    function subframeLoaded()
-    {
-        var frameDiv = document.getElementById('framediv');
-        frameDiv.innerHTML = 'PASSED';
-        if (window.layoutTestController)
-            layoutTestController.notifyDone();
-    }
-
-    function dumpRequestStatus(request)
-    {
-        try {
-            log("Ready State: " + request.readyState);
-        } catch (ex) {
-            log("Exception getting status: " + ex.message);
-        }
-    }
-
-    function log(message)
-    {
-        var item = document.createElement("li");
-        item.appendChild(document.createTextNode(message));
-        consoleMessages.appendChild(item);
-    }
-</script>
-<div id="framediv">
-<iframe src="resources/xmlhttprequest-in-unload.html" width=50 height=10 border=0></iframe>
-</div>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/frame-unload-crash-1.html b/tests/tests/webkitsecurity/assets/frame-unload-crash-1.html
deleted file mode 100644
index f83f8ae..0000000
--- a/tests/tests/webkitsecurity/assets/frame-unload-crash-1.html
+++ /dev/null
@@ -1,5 +0,0 @@
-<html>
-<body onload="location='frame-unload-crash-3.html'">
-  <iframe src="frame-unload-crash-2.html">
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/frame-unload-crash-2.html b/tests/tests/webkitsecurity/assets/frame-unload-crash-2.html
deleted file mode 100644
index 75e54a1..0000000
--- a/tests/tests/webkitsecurity/assets/frame-unload-crash-2.html
+++ /dev/null
@@ -1,19 +0,0 @@
-<html>
-<head>
-<script>
-// When we create an XHR from onunload, we expect it to be cancelled almost
-// immediately afterwards.  When that happens the XHR's onabort handler is
-// called.  The XHR created from there is cancelled again, but at a later point
-// after this FRAME has already been detached from its parent.
-var requests = [];
-function startRequest() {
-  var x = new XMLHttpRequest();
-  x.open("GET", location, true);
-  x.onabort = startRequest;
-  x.send(null);
-  requests.push(x);
-}
-</script>
-</head>
-<body onunload="startRequest()"></body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/frame-unload-crash-3.html b/tests/tests/webkitsecurity/assets/frame-unload-crash-3.html
deleted file mode 100644
index cfa1890..0000000
--- a/tests/tests/webkitsecurity/assets/frame-unload-crash-3.html
+++ /dev/null
@@ -1,3 +0,0 @@
-<html>
-<body onload="parent.done()"></body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/frame-unload-crash.html b/tests/tests/webkitsecurity/assets/frame-unload-crash.html
deleted file mode 100644
index 32fa8c0..0000000
--- a/tests/tests/webkitsecurity/assets/frame-unload-crash.html
+++ /dev/null
@@ -1,26 +0,0 @@
-<html>
-<head>
-<script>
-
-if (window.layoutTestController) {
-    layoutTestController.waitUntilDone();
-    layoutTestController.dumpAsText();
-}
-
-function done()
-{
-    document.getElementById("results").appendChild(document.createTextNode("PASS"));
-    layoutTestController.notifyDone();
-}
-
-</script>
-</head>
-<body>
-<p>
-  This is a test for <a href="https://bugs.webkit.org/show_bug.cgi?id=25136">bug 25136</a>: <i>CRASH in DocumentLoader::removeSubresourceLoader
-  due to null m_frame.</i> If successful, PASS should be printed below.
-</p>
-<p id="results" class="pass"></p>
-<iframe style="border: 0" src="resources/frame-unload-crash-1.html">
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/frameless-media-element-crash.html b/tests/tests/webkitsecurity/assets/frameless-media-element-crash.html
deleted file mode 100644
index 44b4279..0000000
--- a/tests/tests/webkitsecurity/assets/frameless-media-element-crash.html
+++ /dev/null
@@ -1,12 +0,0 @@
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-var doc = document.implementation.createHTMLDocument();
-doc.open();
-doc.write('<video controls></video>');
-doc.close();
-
-</script>
-<p>Creating a video element in a frameless document should not crash WebKit.
-<p>This test passes if it does not crash.
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/generated-after-counter-doesnt-crash.html-disabled b/tests/tests/webkitsecurity/assets/generated-after-counter-doesnt-crash.html-disabled
deleted file mode 100644
index 271c310..0000000
--- a/tests/tests/webkitsecurity/assets/generated-after-counter-doesnt-crash.html-disabled
+++ /dev/null
@@ -1,26 +0,0 @@
-<html>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-<style type="text/css">
-
-ruby:after{
-	counter-reset: g -2532653 K -48696899414062 ll -48202514648437 rr -1821899414062;
-}
-ruby::after{
-	display: table;
-	content: url("http://xx");
-}
-
-</style>
-	<ruby>
-		<ruby>
-			<ruby>
-<style type="text/css">
-ruby{
-	float: left;
-}
-</style>
-	<ruby>
-This test passes if it doesn't crash.
diff --git a/tests/tests/webkitsecurity/assets/generated-before-and-after-counter-doesnt-crash.html-disabled b/tests/tests/webkitsecurity/assets/generated-before-and-after-counter-doesnt-crash.html-disabled
deleted file mode 100644
index 9ec77f7..0000000
--- a/tests/tests/webkitsecurity/assets/generated-before-and-after-counter-doesnt-crash.html-disabled
+++ /dev/null
@@ -1,33 +0,0 @@
-<html>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-<style type="text/css">
-
-ruby:before{
-	counter-reset: g -2532653 K -48696899414062 ll -48202514648437 rr -1821899414062;
-}
-ruby::before{
-	display: table;
-	content: url("http://xx");
-}
-ruby:after{
-	counter-reset: g -2532653 K -48696899414062 ll -48202514648437 rr -1821899414062;
-}
-ruby::after{
-	display: table;
-	content: url("http://yy");
-}
-
-</style>
-	<ruby>
-		<ruby>
-			<ruby>
-<style type="text/css">
-ruby{
-	float: left;
-}
-</style>
-	<ruby>
-This test passes if it doesn't crash.
diff --git a/tests/tests/webkitsecurity/assets/generated-before-counter-doesnt-crash.html b/tests/tests/webkitsecurity/assets/generated-before-counter-doesnt-crash.html
deleted file mode 100644
index d4f161e..0000000
--- a/tests/tests/webkitsecurity/assets/generated-before-counter-doesnt-crash.html
+++ /dev/null
@@ -1,26 +0,0 @@
-<html>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-<style type="text/css">
-
-ruby:before{
-	counter-reset: g -2532653 K -48696899414062 ll -48202514648437 rr -1821899414062;
-}
-ruby::before{
-	display: table;
-	content: url("http://xx");
-}
-
-</style>
-	<ruby>
-		<ruby>
-			<ruby>
-<style type="text/css">
-ruby{
-	float: right;
-}
-</style>
-	<ruby>
-This test passes if it doesn't crash.
diff --git a/tests/tests/webkitsecurity/assets/generated-child-split-flow-crash-expected.png b/tests/tests/webkitsecurity/assets/generated-child-split-flow-crash-expected.png
deleted file mode 100644
index ca9f6a4..0000000
--- a/tests/tests/webkitsecurity/assets/generated-child-split-flow-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/generated-child-split-flow-crash.html b/tests/tests/webkitsecurity/assets/generated-child-split-flow-crash.html
deleted file mode 100644
index d06c4f4..0000000
--- a/tests/tests/webkitsecurity/assets/generated-child-split-flow-crash.html
+++ /dev/null
@@ -1,29 +0,0 @@
-<!DOCTYPE html>

-<html style="font-family: ahem; -webkit-font-smoothing: none;">

-<style>

-    #div1 { 

-        -webkit-column-count: 2;

-    }

-    #span1:after 

-    {

-        display: block;

-        content: counter(c);

-        color: green;

-        -webkit-column-span: all;

-    }

-</style>

-<div id="div1">

-A<span id="span1" style="color: blue">B</span>C

-</div>

-<script>

-function runTest()

-{

-    span1 = document.getElementById('span1');

-    span1.style.display = 'block';

-    document.body.offsetTop;

-    document.body.style.zoom = 2;

-}

-

-window.onload = runTest;

-</script>

-</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/generated-content-crash.html b/tests/tests/webkitsecurity/assets/generated-content-crash.html
deleted file mode 100644
index ad9e954..0000000
--- a/tests/tests/webkitsecurity/assets/generated-content-crash.html
+++ /dev/null
@@ -1,29 +0,0 @@
-<html>
-        <head>
-    <title>Reduction of bug 10198
-        </title>
-        <style type="text/css">
-
-.clearFix:after {
-    content: "."; 
-    display: block; 
-    overflow: hidden;
-}
-
-        </style>
-        <script type="text/javascript">
-           if (window.layoutTestController)
-               layoutTestController.dumpAsText();
-        </script>
-        </head>
-        <body>
-           <p>
-               Test case for <i><a href="https://bugs.webkit.org/show_bug.cgi?id=10198">https://bugs.webkit.org/show_bug.cgi?id=10198</a>
-               REGRESSION: WebKit r15750 crashes while loading anthem.com</i>.
-           </p>
-           <p>
-               No crash means test PASS.
-           </p>
-                <div class="clearFix">
-        </body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/generated-layer-scrollbar-crash.html b/tests/tests/webkitsecurity/assets/generated-layer-scrollbar-crash.html
deleted file mode 100644
index c2b6693..0000000
--- a/tests/tests/webkitsecurity/assets/generated-layer-scrollbar-crash.html
+++ /dev/null
@@ -1,26 +0,0 @@
-<html>
-<head>
-    <title></title>
-    <style type="text/css">
-        div:after {
-            content: ".";
-            display: block; 
-            overflow: scroll;
-        }
-    </style>
-    <script>
-        if (window.layoutTestController)
-            layoutTestController.dumpAsText();
-    </script>
-</head>
-<body>
-    <p>
-        Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=12518">http://bugs.webkit.org/show_bug.cgi?id=12518</a>
-        Betsson.com crashes browser</i>.
-    </p>
-    <p>
-        No crash means PASS.
-    </p>
-    <div></div>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/get-url-with-iframe-target-no-crash.html b/tests/tests/webkitsecurity/assets/get-url-with-iframe-target-no-crash.html
deleted file mode 100644
index 35d1a09..0000000
--- a/tests/tests/webkitsecurity/assets/get-url-with-iframe-target-no-crash.html
+++ /dev/null
@@ -1,21 +0,0 @@
-<html>
-<script>
-function runtest() {
-    if (window.layoutTestController) {
-        layoutTestController.dumpAsText();
-        layoutTestController.waitUntilDone();
-        plg.getURLNotify("data:text/html,<body onload='layoutTestController.notifyDone()'></body>", "frame", "callback");
-        plg.parentNode.removeChild(plg)
-    } else {
-        document.write("Cannot run interactively");
-    }
-}
-</script>
-<body onload="runtest()">
-<embed id="plg" type="application/x-webkit-test-netscape"></embed>
-This tests that we do not crash upon trying to deliver NPP_URLNotify to
-a plugin that has been deleted.
-<div id="result">SUCCESS</div>
-<iframe id="frame"></iframe>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/getMatchedCSSRules-null-crash.html b/tests/tests/webkitsecurity/assets/getMatchedCSSRules-null-crash.html
deleted file mode 100644
index 8fb3ecd..0000000
--- a/tests/tests/webkitsecurity/assets/getMatchedCSSRules-null-crash.html
+++ /dev/null
@@ -1,6 +0,0 @@
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-    var rules = getMatchedCSSRules(null, "", false);
-</script>
-SUCCESS (<code>getMatchedCSSRule(null, ...)</code> did not crash).
diff --git a/tests/tests/webkitsecurity/assets/giant-stylesheet-crash.html b/tests/tests/webkitsecurity/assets/giant-stylesheet-crash.html
deleted file mode 100644
index 6fbe8cc..0000000
--- a/tests/tests/webkitsecurity/assets/giant-stylesheet-crash.html
+++ /dev/null
@@ -1,25 +0,0 @@
-<head>

-<script>

-if (window.layoutTestController)

-    layoutTestController.dumpAsText();

-</script>

-

-<script>

-var styleElement = document.createElement('style');

-styleElement.setAttribute('type', 'text/css');

-

-var str="z";

-for (var i = 0; i < 16; i++) {

-    str += str;

-}

-for (var i = 0; i < 1+(1<<16); i++){

-    var txt = document.createTextNode(str);

-    styleElement.appendChild(txt);

-}

-

-document.getElementsByTagName('head')[0].appendChild(styleElement); 

-</script>

-</head>

-<body>

-This test verifies that creating a huge inline stylesheet doesn't crash.

-</body>

diff --git a/tests/tests/webkitsecurity/assets/glyphref-renderer-create-crash.html b/tests/tests/webkitsecurity/assets/glyphref-renderer-create-crash.html
deleted file mode 100644
index 7c0ae8a..0000000
--- a/tests/tests/webkitsecurity/assets/glyphref-renderer-create-crash.html
+++ /dev/null
@@ -1,14 +0,0 @@
-<html>
-Test passes if it does not crash.
-<svg>
-<glyphref>
-<foreignObject>
-</foreignObject>
-</glyphref>
-</svg>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-</html>
-
diff --git a/tests/tests/webkitsecurity/assets/gradient-on-pseudoelement-crash.html b/tests/tests/webkitsecurity/assets/gradient-on-pseudoelement-crash.html
deleted file mode 100644
index fabf1fa..0000000
--- a/tests/tests/webkitsecurity/assets/gradient-on-pseudoelement-crash.html
+++ /dev/null
@@ -1,17 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<style>
-body:first-line {
-    background-image: -webkit-gradient(linear, 0% 0%, 0% 100%, from(blue), to(green));
-}
-</style>
-<script type="text/javascript" charset="utf-8">
-  if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
-</head>
-<body>
-This test should not crash.
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/hasFocus-frameless-crash.html b/tests/tests/webkitsecurity/assets/hasFocus-frameless-crash.html
deleted file mode 100644
index ab82ea9..0000000
--- a/tests/tests/webkitsecurity/assets/hasFocus-frameless-crash.html
+++ /dev/null
@@ -1,8 +0,0 @@
-<p>This tests that calling HTMLDocument.hasFocus() on a frameless HTMLDocument does not crash.</p>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    var newDoc = document.implementation.createHTMLDocument("");
-    newDoc.hasFocus();
-</script>
diff --git a/tests/tests/webkitsecurity/assets/hidden-iframe-scrollbar-crash.html b/tests/tests/webkitsecurity/assets/hidden-iframe-scrollbar-crash.html
deleted file mode 100644
index d2872e3..0000000
--- a/tests/tests/webkitsecurity/assets/hidden-iframe-scrollbar-crash.html
+++ /dev/null
@@ -1,38 +0,0 @@
-<style>
-::-webkit-scrollbar {
-  width: 16px;
-}
-</style>
-
-<body>
-<iframe id="iframe" width="1"></iframe>
-<p>This tests to make sure that an iframe with custom scrollbars that is
-hidden does not crash the browser when unloaded.  The test passes if it does
-not crash.</p>
-</body>
-
-<script>
-function runTest()
-{
-    if (document.location.search == "?done") {
-        document.body.appendChild(document.createTextNode("PASSED"));
-        if (window.layoutTestController)
-            layoutTestController.notifyDone();
-        return;
-    }
-
-    if (window.layoutTestController) {
-        layoutTestController.waitUntilDone();
-        layoutTestController.dumpAsText();
-    }
-
-    setTimeout(function() {
-      document.getElementById("iframe").style.display = "none";
-
-      // Unload the page to see if the crash is triggered.
-      document.location.href = "?done";
-    }, 0);
-}
-
-runTest();
-</script>
diff --git a/tests/tests/webkitsecurity/assets/hidden-iframe-scrollbar-crash2.html b/tests/tests/webkitsecurity/assets/hidden-iframe-scrollbar-crash2.html
deleted file mode 100644
index 5a26c94..0000000
--- a/tests/tests/webkitsecurity/assets/hidden-iframe-scrollbar-crash2.html
+++ /dev/null
@@ -1,28 +0,0 @@
-<html>
-<body><p>
-This is some text to force a scrollbar to appear.
-This is some text to force a scrollbar to appear.
-This is some text to force a scrollbar to appear.
-</p>
-<img id="i" onbeforeload="beforeload()" onload="pass()">
-</body>
-<script>
-function beforeload()
-{
-    setTimeout(function() {
-        var win = window.parent;
-        win.document.getElementById("iframe").style.display = "none";
-    });
-    return true;
-}
-
-function pass()
-{
-    var win = window.parent;
-    win.document.getElementById("iframe").style.display = "";
-    win.document.body.appendChild(document.createTextNode("PASSED"));
-    if (window.layoutTestController)
-        layoutTestController.notifyDone();
-}
-</script>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/horizontal-box-float-crash.html b/tests/tests/webkitsecurity/assets/horizontal-box-float-crash.html
deleted file mode 100644
index 3850e6c..0000000
--- a/tests/tests/webkitsecurity/assets/horizontal-box-float-crash.html
+++ /dev/null
@@ -1,38 +0,0 @@
-<html>
-<body onload="runTest()">
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    function runTest()
-    {
-        document.body.offsetTop;
-        var container = document.getElementById('container');
-        var test = document.getElementById('test');
-        var blockquote = document.getElementById('blockquote');
-        blockquote.parentNode.removeChild(blockquote);
-        test.appendChild(blockquote);
-        document.body.offsetTop;
-        test.parentNode.removeChild(test);
-        if (window.layoutTestController) {
-            // Force a focus in which forces a paint that can trigger the crash.
-            layoutTestController.setWindowIsKey(false);
-            layoutTestController.setWindowIsKey(true);
-            document.getElementById("results").innerHTML = "PASS";
-        }
-    }
-</script>
-<div>This test passes if it does not crash.</div>
-<div id="container" style="display: -webkit-box;">
-    <div id="test">
-        <span style="float: right;">This is a floating span.</span>
-        <span>.</span>
-    </div>
-    <span>
-        <ol id="results">
-            <blockquote id="blockquote">blockquote</blockquote>
-        </ol>
-    </span>
-</div>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/hover-style-recalc-crash.html b/tests/tests/webkitsecurity/assets/hover-style-recalc-crash.html
deleted file mode 100644
index e86c13d..0000000
--- a/tests/tests/webkitsecurity/assets/hover-style-recalc-crash.html
+++ /dev/null
@@ -1,26 +0,0 @@
-<style>
-    div#a { width: 100px; height: 100px; background-color: lightblue; }
-    div#b { display: none; }
-    div#b a { display: block; width: 100px; height: 100px; background-color: blue; }
-    div#a:hover + div { display:block; }
-</style>
-<p>
-    Test for <i><a href="rdar://problem/7873647">rdar://problem/7873647</a>
-    Crash when updating hover state</i>.
-</p>
-<p>
-    Hover over the light blue square, then move down into the blue square. The browser should not crash.
-</p>
-<div id="a"></div>
-<div id="b">
-    <a></a>
-</div>
-<script>
-    if (window.layoutTestController) {
-        layoutTestController.dumpAsText();
-        document.body.offsetTop;
-        var y = document.getElementById("a").getBoundingClientRect().top;
-        eventSender.mouseMoveTo(50, y + 50);
-        eventSender.mouseMoveTo(50, y + 150);
-    }
-</script>
diff --git a/tests/tests/webkitsecurity/assets/hover-timer-crash.html b/tests/tests/webkitsecurity/assets/hover-timer-crash.html
deleted file mode 100644
index c4494ab..0000000
--- a/tests/tests/webkitsecurity/assets/hover-timer-crash.html
+++ /dev/null
@@ -1,43 +0,0 @@
-<html>
-<head>
-    <script type="text/javascript">
-        function finish()
-        {
-            if (window.layoutTestController)
-                layoutTestController.notifyDone();
-        }
-
-        function crash_step2()
-        {
-          var target = document.getElementById("target");
-          target.contentDocument.body.parentNode.removeChild(target.contentDocument.body);
-          target.parentNode.removeChild(target);
-          setTimeout(finish, 10);
-        }
-
-        function test()
-        {
-            if (window.layoutTestController) {
-                layoutTestController.dumpAsText();
-                layoutTestController.waitUntilDone();
-                var target = document.getElementById("target");
-                eventSender.mouseMoveTo(target.offsetLeft + target.offsetWidth / 2, target.offsetTop + target.offsetHeight / 2);
-                setTimeout(crash_step2, 100);
-            }
-        }
-    </script>
-</head>
-<body onload="test()">
-    <p>
-        Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=13124">http://bugs.webkit.org/show_bug.cgi?id=13124</a>
-        REGRESSION: Reproducible crash in Widget::getView</i>.
-    </p>
-    <p>
-        To test interactively, move the mouse into the yellow rect and wait a second.
-    </p>
-    <p>
-        No crash means SUCCESS.
-    </p>
-    <iframe onmouseover="if (!window.layoutTestController) setTimeout(crash_step2, 1000)" id="target" src="data:text/html,<body bgcolor='yellow'></body>" style="border: solid black"></iframe>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/huge-column-gap-crash.html b/tests/tests/webkitsecurity/assets/huge-column-gap-crash.html
deleted file mode 100644
index 1580182..0000000
--- a/tests/tests/webkitsecurity/assets/huge-column-gap-crash.html
+++ /dev/null
@@ -1,20 +0,0 @@
-<html>
-<head>
-<style>
-body {
-    -webkit-column-width: .600pt;
-    -webkit-column-gap: 2261953074155095154;
-}
-</style>
-
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-</head>
-
-<body class="test">
-This test passes if it does not crash.
-</body>
-
-</html>
diff --git a/tests/tests/webkitsecurity/assets/id-attribute-with-namespace-crash.html b/tests/tests/webkitsecurity/assets/id-attribute-with-namespace-crash.html
deleted file mode 100644
index df238a5..0000000
--- a/tests/tests/webkitsecurity/assets/id-attribute-with-namespace-crash.html
+++ /dev/null
@@ -1,42 +0,0 @@
-<html>
-<head>
-<script>
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-}
-
-gc = window.gc || function()
-{
-    if (window.GCController)
-        return GCController.collect();
-
-    for (var i = 0; i < 10000; ++i)
-        var s = new String("AAAA");
-}
-
-window.onload = function()
-{
-    element = document.body.appendChild(document.createElement("a"));
-
-    element.setAttributeNS("namespace", "id", "foo");
-    element.setAttribute("id", "bar");
-    
-    document.body.removeChild(element);
-    element = null;
-    gc();
-    
-    setTimeout(finishTest, 0);
-}
-
-finishTest = function()
-{
-    document.getElementById("bar");
-
-    if (window.layoutTestController)
-        layoutTestController.notifyDone();
-}
-</script>
-</head>
-<body>PASS</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/ident-crashes-topnode-is-text.html b/tests/tests/webkitsecurity/assets/ident-crashes-topnode-is-text.html
deleted file mode 100644
index 1529cd0..0000000
--- a/tests/tests/webkitsecurity/assets/ident-crashes-topnode-is-text.html
+++ /dev/null
@@ -1,16 +0,0 @@
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function runTest() {
-    window.getSelection().setBaseAndExtent(start, 0, null, 0);
-    document.execCommand("Indent");
-
-    document.writeln('execCommand("Indent") was crashing if the top element to be formatted is actually not an element.<br>');
-    document.writeln('The test has passed if it does not crash.<br><br>')
-    document.writeln('PASS');
-}
-</script>
-<body onLoad="runTest();">
-    ><defs contenteditable="true" id="start">
-        <rt>AAAAAAA0A0AAAA00
diff --git a/tests/tests/webkitsecurity/assets/iframe-contentWindow-crash.html b/tests/tests/webkitsecurity/assets/iframe-contentWindow-crash.html
deleted file mode 100644
index d4bd0eb..0000000
--- a/tests/tests/webkitsecurity/assets/iframe-contentWindow-crash.html
+++ /dev/null
@@ -1,11 +0,0 @@
-This is a test for <a href="http://bugs.webkit.org/show_bug.cgi?id=13868">http://bugs.webkit.org/show_bug.cgi?id=13868</a> 
-REGRESSION: crash on accessing a new iframe's contentWindow property.
-
-This tests HTMLIFrameElement.contentWindow.
-
-If there is no crash this test passes.
-<script type="text/javascript">
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-    document.createElement('iframe').contentWindow;
-</script>
diff --git a/tests/tests/webkitsecurity/assets/iframe-crash-on-missing-image.xhtml b/tests/tests/webkitsecurity/assets/iframe-crash-on-missing-image.xhtml
deleted file mode 100644
index 5acbe1d..0000000
--- a/tests/tests/webkitsecurity/assets/iframe-crash-on-missing-image.xhtml
+++ /dev/null
@@ -1,13 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE html
-   PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
-   "xhtml1-transitional.dtd">
-<html xmlns='http://www.w3.org/1999/xhtml'>
-<head>
-<title>NIST DOM HTML Test - IFRAME</title>
-
-<script type='text/javascript' src='../../dom/xhtml/level2/html/selfxhtml.js'></script><script charset='UTF-8' type='text/javascript' src='../../dom/xhtml/level2/html/HTMLIFrameElement01.js'></script><script type='text/javascript'>function loadComplete() { startTest(); }</script></head>
-<body onload="loadComplete()">
-<iframe longdesc="about:blank" marginheight="10" marginwidth="5" width="60" height="50" name="Iframe1" frameborder="1" scrolling="yes" src="right.png" align="top">IFRAME1</iframe>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/iframe-flattening-crash.html b/tests/tests/webkitsecurity/assets/iframe-flattening-crash.html
deleted file mode 100644
index 02c0bbf..0000000
--- a/tests/tests/webkitsecurity/assets/iframe-flattening-crash.html
+++ /dev/null
@@ -1,32 +0,0 @@
-<html>
-<head>
-    <script type="text/javascript">
-        if (window.layoutTestController) {
-            layoutTestController.dumpAsText();
-            layoutTestController.waitUntilDone();
-            layoutTestController.setFrameFlatteningEnabled(true);
-        }
-    </script>
-</head>
-<body>
-    <style>body { background-color: green; }</style>
-    <p>This test passes if it does not crash <a href="https://bugs.webkit.org/show_bug.cgi?id=52449">https://bugs.webkit.org/show_bug.cgi?id=52449</a></p>
-
-    <p><iframe id="if"  width="20%" height="20%" scrolling=auto src="data:text/html,
-    <html>
-    <script>
-        function test2(){
-            var i = document.getElementsByTagName('html')[0].clientWidth; 
-            if (window.layoutTestController)
-                layoutTestController.notifyDone();
-            if (window.layoutTestController)
-                layoutTestController.setFrameFlatteningEnabled(true);
-        }
-    </script>
-    <body onresize='test2();'>
-    <div style='position: absolute; width: 400px; height: 400px; left: 0; top: 0px;' id='p'><input id='in' value='abcd'></div>
-    </body></html>
-    ">
-</body>
-</html>
-
diff --git a/tests/tests/webkitsecurity/assets/iframe-flattening-selection-crash.html b/tests/tests/webkitsecurity/assets/iframe-flattening-selection-crash.html
deleted file mode 100644
index 7f35bd3..0000000
--- a/tests/tests/webkitsecurity/assets/iframe-flattening-selection-crash.html
+++ /dev/null
@@ -1,36 +0,0 @@
-<html>
-<head>
-    <script type="text/javascript">
-        if (window.layoutTestController) {
-            layoutTestController.dumpAsText();
-            layoutTestController.waitUntilDone();
-            layoutTestController.setFrameFlatteningEnabled(true);
-        }
-
-        setTimeout(function() {
-            if (window.layoutTestController)
-                layoutTestController.notifyDone();
-        }, 500);
-
-        function test() {
-            if (window.layoutTestController)
-                layoutTestController.setFrameFlatteningEnabled(true);
-            document.getElementById("if").contentWindow.document.getElementById('in').focus();
-            document.getElementById("if").contentWindow.document.getElementById('p').style.top = "20px";
-        }
-    </script>
-</head>
-<body>
-    <style>body { background-color: green; }</style>
-    <p>This test passes if it does not crash <a href="https://bugs.webkit.org/show_bug.cgi?id=52449">https://bugs.webkit.org/show_bug.cgi?id=52449</a></p>
-
-    <p><iframe id="if" onload="test();" width="20%" height="20%" scrolling=auto src="data:text/html,
-    <html>
-    <body'>
-    <div style='position: absolute; width: 400px; height: 400px; left: 0; top: 0px;' id='p'><input id='in' value='abcd'></div>
-    </body></html>
-    ">
-</body>
-</html>
-
-
diff --git a/tests/tests/webkitsecurity/assets/iframe-invalid-source-crash.html b/tests/tests/webkitsecurity/assets/iframe-invalid-source-crash.html
deleted file mode 100644
index c81bddf..0000000
--- a/tests/tests/webkitsecurity/assets/iframe-invalid-source-crash.html
+++ /dev/null
@@ -1,13 +0,0 @@
-<html>
-<head>
-    <script>
-        if (window.layoutTestController)
-            layoutTestController.dumpAsText();
-    </script>
-</head>
-    <body>
-        <iframe src="file:"></iframe>
-        This tests that we don't crash if an iframe has an invalid source. 
-        <div>SUCCESS - didn't crash</div>
-    </body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/iframe-onload-crash-mac.html b/tests/tests/webkitsecurity/assets/iframe-onload-crash-mac.html
deleted file mode 100644
index 79dafef..0000000
--- a/tests/tests/webkitsecurity/assets/iframe-onload-crash-mac.html
+++ /dev/null
@@ -1,19 +0,0 @@
-<meta><input><h6><nobr></nobr><datagrid><ins><button><em><iframe onload="
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.setEditingBehavior('mac');
-}
-
-if (document.counter)
-    document.counter++;
-else
-    document.counter = 1;
-
-if (document.counter <= 16) {
-    document.designMode='on';
-    document.execCommand('selectall');
-    document.execCommand('italic');
-    document.execCommand('RemoveFormat');
-    document.execCommand('inserthtml', false);
-    document.body.innerHTML='PASS';
-} ">x
diff --git a/tests/tests/webkitsecurity/assets/iframe-onload-crash-unix.html b/tests/tests/webkitsecurity/assets/iframe-onload-crash-unix.html
deleted file mode 100644
index a3f8ba2..0000000
--- a/tests/tests/webkitsecurity/assets/iframe-onload-crash-unix.html
+++ /dev/null
@@ -1,19 +0,0 @@
-<meta><input><h6><nobr></nobr><datagrid><ins><button><em><iframe onload="
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.setEditingBehavior('unix');
-}
-
-if (document.counter)
-    document.counter++;
-else
-    document.counter = 1;
-
-if (document.counter <= 16) {
-    document.designMode='on';
-    document.execCommand('selectall');
-    document.execCommand('italic');
-    document.execCommand('RemoveFormat');
-    document.execCommand('inserthtml', false);
-    document.body.innerHTML='PASS';
-} ">x
diff --git a/tests/tests/webkitsecurity/assets/iframe-onload-crash-win.html b/tests/tests/webkitsecurity/assets/iframe-onload-crash-win.html
deleted file mode 100644
index 567366b..0000000
--- a/tests/tests/webkitsecurity/assets/iframe-onload-crash-win.html
+++ /dev/null
@@ -1,19 +0,0 @@
-<meta><input><h6><nobr></nobr><datagrid><ins><button><em><iframe onload="
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.setEditingBehavior('win');
-}
-
-if (document.counter)
-    document.counter++;
-else
-    document.counter = 1;
-
-if (document.counter <= 16) {
-    document.designMode='on';
-    document.execCommand('selectall');
-    document.execCommand('italic');
-    document.execCommand('RemoveFormat');
-    document.execCommand('inserthtml', false);
-    document.body.innerHTML='PASS';
-} ">x
diff --git a/tests/tests/webkitsecurity/assets/iframe-onload-remove-self-no-crash-child.html b/tests/tests/webkitsecurity/assets/iframe-onload-remove-self-no-crash-child.html
deleted file mode 100644
index c7daf2d..0000000
--- a/tests/tests/webkitsecurity/assets/iframe-onload-remove-self-no-crash-child.html
+++ /dev/null
@@ -1,3 +0,0 @@
-<html>
-<script src="iframe-onload-remove-self-no-crash.js"></script>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/iframe-onload-remove-self-no-crash.html b/tests/tests/webkitsecurity/assets/iframe-onload-remove-self-no-crash.html
deleted file mode 100644
index fca7d11..0000000
--- a/tests/tests/webkitsecurity/assets/iframe-onload-remove-self-no-crash.html
+++ /dev/null
@@ -1,13 +0,0 @@
-<html>
-<script>
-if (window.layoutTestController)
-  layoutTestController.dumpAsText();
-</script>
-<script src="resources/iframe-onload-remove-self-no-crash.js"></script>
-<body>
-This tests that setting remove a child frame in onload event handler
-does not crash the renderer.
-<br>
-<iframe src="resources/iframe-onload-remove-self-no-crash-child.html"></iframe>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/iframe-onload-remove-self-no-crash.js b/tests/tests/webkitsecurity/assets/iframe-onload-remove-self-no-crash.js
deleted file mode 100644
index 2d3771e..0000000
--- a/tests/tests/webkitsecurity/assets/iframe-onload-remove-self-no-crash.js
+++ /dev/null
@@ -1,16 +0,0 @@
-function onWindowLoad() {
-  var doc = top.document;
-  var b = doc.body;
-
-  var x = doc.getElementById('x');
-  if (x) {
-    b.removeChild(x);
-  }
-
-  x = doc.createElement("iframe");
-  x.setAttribute('id','x');
-  // appendChild triggers load
-  b.appendChild(x);
-}
-
-window.addEventListener("load", onWindowLoad, false);
diff --git a/tests/tests/webkitsecurity/assets/iframe-option-crash-expected.png b/tests/tests/webkitsecurity/assets/iframe-option-crash-expected.png
deleted file mode 100644
index 58edac4..0000000
--- a/tests/tests/webkitsecurity/assets/iframe-option-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/iframe-option-crash.xhtml b/tests/tests/webkitsecurity/assets/iframe-option-crash.xhtml
deleted file mode 100644
index 5b43769..0000000
--- a/tests/tests/webkitsecurity/assets/iframe-option-crash.xhtml
+++ /dev/null
@@ -1,30 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-
-<script>
-function test()
-{
-    if (window.layoutTestController)
-        layoutTestController.waitUntilDone();
-
-    var frame = document.getElementsByTagName("iframe")[0];
-    var body = document.getElementById("body");
-    body.appendChild(document.getElementById("option"));
-    body.appendChild(frame);
-
-    document.getElementById("result").appendChild(document.createTextNode("If no crash while painting, the test passed (requires pixel test mode)."));
-
-    if (window.layoutTestController)
-        layoutTestController.notifyDone();
-}
-</script>
-
-</head>
-
-<body id="body" onload="test()">
-      <div id="result"></div>
-      <iframe src="javascript:55"/>
-      <option id="option"><iframe src="data:text/html,11"/></option>
-</body>
-
-</html>
diff --git a/tests/tests/webkitsecurity/assets/iframe-plugin-load-remove-document-crash.html b/tests/tests/webkitsecurity/assets/iframe-plugin-load-remove-document-crash.html
deleted file mode 100644
index 0765e9b..0000000
--- a/tests/tests/webkitsecurity/assets/iframe-plugin-load-remove-document-crash.html
+++ /dev/null
@@ -1,21 +0,0 @@
-<html>

-<body onload="runTest()">

-<script>

-    if (window.layoutTestController)

-    {

-        layoutTestController.dumpAsText();

-        layoutTestController.waitUntilDone();

-    }

-    

-    function runTest()

-    {

-        document.body.innerHTML = 'PASS';

-        

-        if (layoutTestController)

-            layoutTestController.notifyDone();

-    }

-</script>

-<iframe src="data:application/x-webkit-test-netscape,foo"></iframe>

-</body>

-</html>

-

diff --git a/tests/tests/webkitsecurity/assets/ignored-result-null-comparison-crash.html b/tests/tests/webkitsecurity/assets/ignored-result-null-comparison-crash.html
deleted file mode 100644
index 84b1f6d..0000000
--- a/tests/tests/webkitsecurity/assets/ignored-result-null-comparison-crash.html
+++ /dev/null
@@ -1,10 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="script-tests/ignored-result-null-comparison-crash.js"></script>
-<script src="resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/ignored-result-null-comparison-crash.js b/tests/tests/webkitsecurity/assets/ignored-result-null-comparison-crash.js
deleted file mode 100644
index 19e91ac..0000000
--- a/tests/tests/webkitsecurity/assets/ignored-result-null-comparison-crash.js
+++ /dev/null
@@ -1,19 +0,0 @@
-description(
-"This tests that bytecode generation doesn't crash on a comparison to null with an ignored result."
-);
-
-function equalToNullTest(a)
-{
-    a == null;
-    return true;
-}
-
-shouldBeTrue("equalToNullTest()");
-
-function notEqualToNullTest(a)
-{
-    a != null;
-    return true;
-}
-
-shouldBeTrue("notEqualToNullTest()");
diff --git a/tests/tests/webkitsecurity/assets/ignored-result-ref-crash.html b/tests/tests/webkitsecurity/assets/ignored-result-ref-crash.html
deleted file mode 100644
index d93d0b9..0000000
--- a/tests/tests/webkitsecurity/assets/ignored-result-ref-crash.html
+++ /dev/null
@@ -1,10 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="script-tests/ignored-result-ref-crash.js"></script>
-<script src="resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/ignored-result-ref-crash.js b/tests/tests/webkitsecurity/assets/ignored-result-ref-crash.js
deleted file mode 100644
index c3ccd23..0000000
--- a/tests/tests/webkitsecurity/assets/ignored-result-ref-crash.js
+++ /dev/null
@@ -1,63 +0,0 @@
-description(
-"This tests that bytecode code generation doesn't crash when it encounters odd cases of an ignored result."
-);
-
-function emptyStatementDoWhileTest()
-{
-    do
-        ;
-    while (false) { }
-    return true;
-}
-
-shouldBeTrue("emptyStatementDoWhileTest()");
-
-function debuggerDoWhileTest()
-{
-    do
-        debugger;
-    while (false) { }
-    return true;
-}
-
-shouldBeTrue("debuggerDoWhileTest()");
-
-function continueDoWhileTest()
-{
-    var i = 0;
-    do
-        i++;
-    while (i < 10) {
-        do
-            continue;
-        while (false) { }
-    }
-    return true;
-}
-
-shouldBeTrue("continueDoWhileTest()");
-
-function breakDoWhileTest()
-{
-    var i = 0;
-    do
-        i++;
-    while (i < 10) {
-        do
-            continue;
-        while (false) { }
-    }
-    return true;
-}
-
-shouldBeTrue("breakDoWhileTest()");
-
-function tryDoWhileTest()
-{
-    do
-        try { } catch (o) { }
-    while (false) { }
-    return true;
-}
-
-shouldBeTrue("tryDoWhileTest()");
diff --git a/tests/tests/webkitsecurity/assets/image-empty-crash.html b/tests/tests/webkitsecurity/assets/image-empty-crash.html
deleted file mode 100644
index 265c405..0000000
--- a/tests/tests/webkitsecurity/assets/image-empty-crash.html
+++ /dev/null
@@ -1,20 +0,0 @@
-<html>
-<head>
-    <title></title>
-    <script type="text/javascript">
-        if (window.layoutTestController)
-            layoutTestController.dumpAsText();
-    </script>
-</head>
-<body>
-    <p>
-        This is a test for <i><a href="https://bugs.webkit.org/show_bug.cgi?id=10202">https://bugs.webkit.org/show_bug.cgi?id=10202</a>
-        REGRESSION: Repro crash when loading an empty image document</i>.
-    </p>
-    <p>
-        No crash means test PASS.
-    </p>
-    <hr>
-    <iframe src="data:image/png,"></iframe>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/image-map-title-causes-crash.html b/tests/tests/webkitsecurity/assets/image-map-title-causes-crash.html
deleted file mode 100644
index cdf22c9..0000000
--- a/tests/tests/webkitsecurity/assets/image-map-title-causes-crash.html
+++ /dev/null
@@ -1,47 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">

-<html>

-<head>

-<script>

-

-    function removeAreaElement() {

-        document.getElementById("test").innerHTML=1

-    }

-

-    function queryTitleOnDecendants(accessibilityObject) {

-        accessibilityObject.title

-

-        var count = accessibilityObject.childrenCount;

-        for (var i = 0; i < count; ++i)

-            queryTitleOnDecendants(accessibilityObject.childAtIndex(i));

-    }

-</script>

-<script src="../fast/js/resources/js-test-pre.js"></script>

-</head>

-<body>

-

-<img usemap="#map">

-<map name="map" id="test"><area href="javascript:document.getElementById('result').innerHTML='area clicked'" /></map>

-

-<p id="description"></p>

-<div id="console"></div>

-

-<script>

-    description("Requesting the title of an AccessibilityImageMapLink can cause a crash when the map's area element has been removed.");

-

-    if (window.accessibilityController) {

-        // First build up full accessibility tree.

-        document.body.focus();

-        queryTitleOnDecendants(accessibilityController.focusedElement);

-        

-        removeAreaElement()

-        

-        // Now call request the title for each accessibility object.

-        document.body.focus();

-        queryTitleOnDecendants(accessibilityController.focusedElement);

-    }

-

-</script>

-

-<script src="../fast/js/resources/js-test-post.js"></script>

-</body>

-</html>

diff --git a/tests/tests/webkitsecurity/assets/image-map-update-parent-crash.html b/tests/tests/webkitsecurity/assets/image-map-update-parent-crash.html
deleted file mode 100644
index dfe4697..0000000
--- a/tests/tests/webkitsecurity/assets/image-map-update-parent-crash.html
+++ /dev/null
@@ -1,53 +0,0 @@
-<html>
-<head>
-<script src="../fast/js/resources/js-test-pre.js"></script>
-
-<script>
-
-if (window.layoutTestController)
-  layoutTestController.waitUntilDone();
-
-function buildAccessibilityTree(accessibilityObject, indent) {
-    var count = accessibilityObject.childrenCount;
-    for (var i = 0; i < count; ++i) {
-         if (!buildAccessibilityTree(accessibilityObject.childAtIndex(i), indent + 1))
-            return false;
-    }
-
-    return true;
-}
-
-function runAXTest() {
-
-
-   description("This tests that an image map's hold on it's parent will be cleared if the parent goes away.");
-
-   // First access all children using AX
-   buildAccessibilityTree(accessibilityController.rootElement, 0);
-
-   var child = document.getElementById('img'); child.parentNode.removeChild(child);
- 
-   // Now verify we haven't crashed.
-   buildAccessibilityTree(accessibilityController.rootElement, 0);
-
-   if (window.layoutTestController)
-       layoutTestController.notifyDone();
-}
-</script>
-
-</head>
-<body>
-
-<map name="map">
-<div id="o7"></div>
-<area id="o20" href="#"></area></map>
-
-<img id="img" usemap="#map"><span></span> 
-
-<script>setTimeout("runAXTest();", 1);</script> 
-
-<p id="description"></p>
-<div id="console"></div>
-
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/imagemap-norender-crash.html b/tests/tests/webkitsecurity/assets/imagemap-norender-crash.html
deleted file mode 100644
index d319723..0000000
--- a/tests/tests/webkitsecurity/assets/imagemap-norender-crash.html
+++ /dev/null
@@ -1,28 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../js/resources/js-test-pre.js"></script>
-<body id="body">
-
-<h1 id="header" tabindex=0>start element</h1>
-<div><img src="resources/abe.png" alt="test" style="width:679px; height:112px" usemap="#Map"></div>
-<div style="display:none"><map name="Map" id="Map"><area shape="rect" coords=coords="5,48,247,97" href="http://www.webkit.org/" target="_blank" id="area1"/></map></div>
-
-<p id="description"></p>
-<div id="console"></div>
-
-<script>
-
-    description("This tests tabbing to an image map link where the map might not have a renderer won't crash.");
-
-    // start at the right place
-    document.getElementById("header").focus();
-
-    // tab forward
-    eventSender.keyDown('\t');
-    shouldBe("document.activeElement.id", "'area1'");
-</script>
-
-<script src="../js/resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/imbricated-flow-threads-crash.html b/tests/tests/webkitsecurity/assets/imbricated-flow-threads-crash.html
deleted file mode 100644
index 5b27d51..0000000
--- a/tests/tests/webkitsecurity/assets/imbricated-flow-threads-crash.html
+++ /dev/null
@@ -1,69 +0,0 @@
-<html>
-<head>
-    <style type="text/css">
-    article{
-        -webkit-flow-into: article;
-    }
-    .region{
-        -webkit-flow-from: article;
-    }
-    #layout{
-        -webkit-flow-into: pages;
-    }
-    .page{
-        -webkit-flow-from: pages;
-    } 
-    #layout .region{
-        width: 50%;
-        background-color: lightgreen;
-        height: 100%;
-    }
-    #layout,
-    #paginator{
-        width: 200px;
-        height: 500px;
-    }
-    #paginator .page{
-        width: 100%;
-        height: 100%;
-        background: #ddd;
-    }
-    .description{
-        color: blue;
-    }
-    </style>
-</head>
-<body>
-    <div><p class="description">Text should be rendered in the green region. The test passes if there is no crash</p></div>
-
-    <div id="layout">
-        <div id="r1" class="region"></div>
-    </div> 
-    <div id="paginator">
-        <div class="page"></div>
-    </div>
-    <article>
-        <p>
-            Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.
-        </p>
-    </article>
-    <script>
-        if (window.layoutTestController) {
-            layoutTestController.dumpAsText();
-            layoutTestController.waitUntilDone();
-        }
-        function addNewRegion() {
-            var oldRegion = document.getElementById("r1");
-            var newRegion = oldRegion.cloneNode(true);
-            oldRegion.parentNode.appendChild(newRegion);
-            if (window.layoutTestController)
-                layoutTestController.notifyDone();
-        }
-        function test() {
-            setTimeout(addNewRegion, 0);
-        }
-
-        window.addEventListener("load", test, false);
-    </script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/implicit-head-in-fragment-crash.html b/tests/tests/webkitsecurity/assets/implicit-head-in-fragment-crash.html
deleted file mode 100644
index 1de9dc9..0000000
--- a/tests/tests/webkitsecurity/assets/implicit-head-in-fragment-crash.html
+++ /dev/null
@@ -1,24 +0,0 @@
-<SCRIPT>
-  if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-  }
-  setTimeout(function () {
-    node = document.createElement("M");
-    document.open();
-    node.innerHTML = "<body>";
-    node.innerHTML = "<p>";
-
-    node = document.createDocumentFragment();
-    document.open();
-    node.innerHTML = "<body>";
-    node.innerHTML = "<p>";
-
-    var b = document.body;
-    document.write("<a href='https://bugs.webkit.org/show_bug.cgi?id=25694'>bug 25694</a><br>");
-    document.write(b ? "FAIL: document.body is not null (but at least we didn't crash)" : "PASS");
-    document.close();
-    if (window.layoutTestController)
-      layoutTestController.notifyDone();
-  }, 0);
-</SCRIPT>
diff --git a/tests/tests/webkitsecurity/assets/import-crash.html b/tests/tests/webkitsecurity/assets/import-crash.html
deleted file mode 100644
index b4d1f8f..0000000
--- a/tests/tests/webkitsecurity/assets/import-crash.html
+++ /dev/null
@@ -1,31 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
-   "http://www.w3.org/TR/html4/loose.dtd">
-
-<html lang="en">
-<head>
-  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
-  <title>Test that @import rule importing keyframes does not crash</title>
-  <style type="text/css"> @import "resources/keyframes.css"; </style>
-  <style type="text/css" media="screen">
-    #box {
-        position: absolute;
-        left: 0;
-        top: 100px;
-        height: 100px;
-        width: 100px;
-        background-color: blue;
-        -webkit-animation-duration: 1s;
-        -webkit-animation-timing-function: linear;
-        -webkit-animation-name: "anim";
-    }
-    </style>
-    <script type="text/javascript" charset="utf-8">
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-  </script>
-</head>
-<body>
-This test simply loads a sheet using @import that contains keyframes, to see if https://bugs.webkit.org/show_bug.cgi?id=20855
-is fixed.
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/indent-node-to-split-to-crash.html b/tests/tests/webkitsecurity/assets/indent-node-to-split-to-crash.html
deleted file mode 100644
index 407dcb0..0000000
--- a/tests/tests/webkitsecurity/assets/indent-node-to-split-to-crash.html
+++ /dev/null
@@ -1,32 +0,0 @@
-<!DOCTYPE html>

-<html>

-<head>

-<script type="text/JavaScript">

-

-function runTest() {

-    document.execCommand('usecss', null, 'false');

-

-    var div = document.getElementById('a');

-    var range = document.createRange();

-    var sNode = div.childNodes[0];

-    var eNode = div.childNodes[3];

-    range.setStart(sNode, NaN);

-    range.setEnd(eNode, NaN);

-    getSelection().removeAllRanges();

-    getSelection().addRange(range);

-

-    document.execCommand('indent', null, true);

-

-    document.body.innerHTML = 'This test ensures WebKit does not crash when intending.<br>PASS';

-

-    layoutTestController.notifyDone();

-}

-

-if (window.layoutTestController) {

-    layoutTestController.dumpAsText();

-    layoutTestController.waitUntilDone();

-}

-

-</script>

-</head>

-<body onload="runTest()"><div contenteditable="" id="a"><div><br><div contenteditable="false"><table></table></div></div><blockquote><input></blockquote><br></br></div></body></html>

diff --git a/tests/tests/webkitsecurity/assets/index-validation-crash-with-buffer-sub-data.html b/tests/tests/webkitsecurity/assets/index-validation-crash-with-buffer-sub-data.html
deleted file mode 100644
index 11405a5..0000000
--- a/tests/tests/webkitsecurity/assets/index-validation-crash-with-buffer-sub-data.html
+++ /dev/null
@@ -1,25 +0,0 @@
-<html>
-<head>
-<script src="../../js/resources/js-test-pre.js"></script>
-<script src="resources/webgl-test.js"></script>
-</head>
-<body>
-<div id="description"></div>
-<div id="console"></div>
-
-<script>
-description('Verifies that the index validation code which is within bufferSubData does not crash.')
-
-var gl = create3DContext();
-
-var elementBuffer = gl.createBuffer();
-gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, elementBuffer);
-gl.bufferData(gl.ELEMENT_ARRAY_BUFFER, 256, gl.STATIC_DRAW);
-var data = new Uint8Array(127);
-gl.bufferSubData(gl.ELEMENT_ARRAY_BUFFER, 63, data);
-testPassed("bufferSubData, when buffer object was initialized with null, did not crash");
-</script>
-
-<script src="../../js/resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/initkeyboardevent-crash.html b/tests/tests/webkitsecurity/assets/initkeyboardevent-crash.html
deleted file mode 100644
index 87c7aac..0000000
--- a/tests/tests/webkitsecurity/assets/initkeyboardevent-crash.html
+++ /dev/null
@@ -1,17 +0,0 @@
-<p>This tests that dispatching a keyboard event created via javascript does
-not crash.</p>
-<p id="results"></p>
-
-<input id="1"> 
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-var evt = document.createEvent("KeyboardEvent");
-evt.initKeyboardEvent("keydown", true, true, window, 0, 0, 0, 0, 0, 0, "a");
-var elt = document.getElementById("1");
-elt.focus();
-elt.dispatchEvent(evt);
-
-document.getElementById("results").innerText = "PASSED";
-</script>
diff --git a/tests/tests/webkitsecurity/assets/inline-body-crash.html b/tests/tests/webkitsecurity/assets/inline-body-crash.html
deleted file mode 100644
index a66959d..0000000
--- a/tests/tests/webkitsecurity/assets/inline-body-crash.html
+++ /dev/null
@@ -1,14 +0,0 @@
-<html>
-<head>
-<title>inline body causes crash</title>
-<script>
-  if (window.layoutTestController)
-      layoutTestController.dumpAsText();
-</script>
-</head>
-
-<body style="display: inline;">
-  <marquee>No crash means PASS</marquee>
-</body>
-
-</html>
diff --git a/tests/tests/webkitsecurity/assets/inline-body-with-scrollbar-crash.html b/tests/tests/webkitsecurity/assets/inline-body-with-scrollbar-crash.html
deleted file mode 100644
index 1eeb0fd..0000000
--- a/tests/tests/webkitsecurity/assets/inline-body-with-scrollbar-crash.html
+++ /dev/null
@@ -1,17 +0,0 @@
-<html>
-<head>
-<title>inline body causes crash with custom scrollbar</title>
-<style>
-  ::-webkit-scrollbar { width: 5px; height: 5px; }
-</style>
-<script>
-  if (window.layoutTestController)
-      layoutTestController.dumpAsText();
-</script>
-</head>
-
-<body style="overflow: scroll; display: inline;">
-  <div style="width: 5000px; height: 5000px;">No crash means PASS</div>
-</body>
-
-</html>
diff --git a/tests/tests/webkitsecurity/assets/inline-box-adjust-position-crash.html b/tests/tests/webkitsecurity/assets/inline-box-adjust-position-crash.html
deleted file mode 100644
index 6bafbb9..0000000
--- a/tests/tests/webkitsecurity/assets/inline-box-adjust-position-crash.html
+++ /dev/null
@@ -1,24 +0,0 @@
-<html>

-<style>

-div {

-   display: inline-block;

-   width: 1px;

-   height: 1px;

-}

-</style>

-<div>

-<br><br>

-</div>

-<div style="overflow: auto">

-<br><br>

-PASS

-</div>

-<script>

-    if (window.layoutTestController)

-        layoutTestController.dumpAsText();

-

-    document.designMode = "on";

-    document.execCommand("SelectAll");

-    document.execCommand("InsertUnorderedList", true, null);

-</script>

-</html>

diff --git a/tests/tests/webkitsecurity/assets/inline-box-adjust-position-crash2.html b/tests/tests/webkitsecurity/assets/inline-box-adjust-position-crash2.html
deleted file mode 100644
index ddc9ca1..0000000
--- a/tests/tests/webkitsecurity/assets/inline-box-adjust-position-crash2.html
+++ /dev/null
@@ -1,14 +0,0 @@
-<html>

-Test passes it if does not crash.

-&nbsp;<img>

-<style>

-* { 

-   position: fixed; 

-   -webkit-text-emphasis-style: sesame;

-}

-</style>

-<script>

-    if (window.layoutTestController)

-        layoutTestController.dumpAsText();

-</script>

-</html>

diff --git a/tests/tests/webkitsecurity/assets/inline-box-wrapper-crash.html b/tests/tests/webkitsecurity/assets/inline-box-wrapper-crash.html
deleted file mode 100644
index dfd2d9d..0000000
--- a/tests/tests/webkitsecurity/assets/inline-box-wrapper-crash.html
+++ /dev/null
@@ -1,24 +0,0 @@
-<html>

-<style>

-    body { direction: rtl; padding-left: 100%; }

-</style>

-<script>

-    if (window.layoutTestController) {

-        layoutTestController.dumpAsText();

-        layoutTestController.waitUntilDone();

-    }

-

-    function runTest() {

-        document.body.innerHTML = "PASS";

-

-        if (window.layoutTestController)

-            layoutTestController.notifyDone();

-    }

-

-    setTimeout("runTest()", 0);

-</script>

-0<image>

-<span>

-A<div></div>

-</span>

-</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/inline-child-height-width-calc-crash.html b/tests/tests/webkitsecurity/assets/inline-child-height-width-calc-crash.html
deleted file mode 100644
index ac03b71..0000000
--- a/tests/tests/webkitsecurity/assets/inline-child-height-width-calc-crash.html
+++ /dev/null
@@ -1,27 +0,0 @@
-<html>

-    <head>

-        <script>

-            if (window.layoutTestController)

-            {

-                layoutTestController.dumpAsText();

-                layoutTestController.waitUntilDone();

-            }

-

-            function runTest() {

-                brElement = document.getElementById('test');

-                document.open();

-                setTimeout(function () {

-                    document.appendChild(brElement);

-                    

-                    alert('PASS');

-                    if (window.layoutTestController)

-                        layoutTestController.notifyDone();

-                }, 0);

-            }

-        </script>

-    </head>

-    <body onload="runTest()">

-        <br id='test'>

-    </body>

-</html>

-

diff --git a/tests/tests/webkitsecurity/assets/inline-children-crash.html b/tests/tests/webkitsecurity/assets/inline-children-crash.html
deleted file mode 100644
index 57a919b..0000000
--- a/tests/tests/webkitsecurity/assets/inline-children-crash.html
+++ /dev/null
@@ -1,31 +0,0 @@
-<html>
-<head>
-<style>
-#flexbox {
-  display: -moz-box;
-  display: -khtml-box;
-  display: box;
-  width: 100px;
-  height: 100px;
-  -moz-box-orient: vertical;
-  -webkit-box-orient: vertical;
-  box-orient: vertical;
-  -webkit-line-clamp: 50%;
-}
-</style>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
-</head>
-<body>
-<p>Remove last block content from a flexbox, leaving only inline content. This should not crash</p>
-
-<div id="flexbox"><div id=remove></div>text</div>
-<script>
-var flexbox = document.getElementById('flexbox');
-flexbox.removeChild(flexbox.firstChild);
-</script>
-</body>
-
-  
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/inline-crash-expected.png b/tests/tests/webkitsecurity/assets/inline-crash-expected.png
deleted file mode 100644
index e610da2..0000000
--- a/tests/tests/webkitsecurity/assets/inline-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/inline-crash.html b/tests/tests/webkitsecurity/assets/inline-crash.html
deleted file mode 100644
index b012e9e..0000000
--- a/tests/tests/webkitsecurity/assets/inline-crash.html
+++ /dev/null
@@ -1,25 +0,0 @@
-<script>
-    onload = function()
-    {
-        if (window.layoutTestController) {
-            layoutTestController.waitUntilDone();
-            layoutTestController.display();
-        }
-        setTimeout(changeColor, 0);
-    }
-
-    changeColor = function()
-    {
-        var span = document.getElementById("span");
-        getSelection().setBaseAndExtent(span, 0, span, 1);
-        if (window.layoutTestController)
-            layoutTestController.notifyDone();
-    }
-</script>
-<p>
-    Test for <i><a href="https://bugs.webkit.org/show_bug.cgi?id=19525">https://bugs.webkit.org/show_bug.cgi?id=19525</a>
-    -webkit-box-reflect in hyperlink causes webkit to crash</i>.
-</p>
-<p>
-    Because it is an inline flow, <span id="span" style="-webkit-box-reflect: below;">this span</span> should not have a reflection, and selecting it should not cause a crash.
-</p>
diff --git a/tests/tests/webkitsecurity/assets/inline-destroy-dirty-lines-crash.html b/tests/tests/webkitsecurity/assets/inline-destroy-dirty-lines-crash.html
deleted file mode 100644
index b8add8f..0000000
--- a/tests/tests/webkitsecurity/assets/inline-destroy-dirty-lines-crash.html
+++ /dev/null
@@ -1,19 +0,0 @@
-<html>
-<body onload="runTest()">
-Test passes it it does not crash.
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    function runTest()
-    {
-        document.body.offsetTop;
-        child = document.getElementById('test');
-        child.parentNode.removeChild(child);
-    }
-</script>
-<br>
-<span id="test"></span>
-</body>
-</html>
-
diff --git a/tests/tests/webkitsecurity/assets/inline-marquee-crash.html b/tests/tests/webkitsecurity/assets/inline-marquee-crash.html
deleted file mode 100644
index 1435e4b..0000000
--- a/tests/tests/webkitsecurity/assets/inline-marquee-crash.html
+++ /dev/null
@@ -1,16 +0,0 @@
-<html>
-<head>
-<title>inline marquee causes crashes</title>
-<script>
-  if (window.layoutTestController)
-      layoutTestController.dumpAsText();
-</script>
-</head>
-
-<body>
-  <div style="opacity: 0.9;">
-    <marquee style="opacity: 0.9; display: inline;">No crash means PASS</marquee>
-  </div>
-</body>
-
-</html>
diff --git a/tests/tests/webkitsecurity/assets/inline-splitting-with-after-float-crash.html b/tests/tests/webkitsecurity/assets/inline-splitting-with-after-float-crash.html
deleted file mode 100755
index cb0c877..0000000
--- a/tests/tests/webkitsecurity/assets/inline-splitting-with-after-float-crash.html
+++ /dev/null
@@ -1,27 +0,0 @@
-<style>

-    .c2:after { float: left; content: "A"; }

-</style>

-PASS, if the script does not cause a crash or ASSERT failure

-<script>

-    function endTest(childSpan) {

-        childSpan.appendChild(divToInsert);

-        if (window.layoutTestController)

-            layoutTestController.notifyDone();

-    }

-    function startTest() {

-        quoteNode = document.createElement('q');

-        document.documentElement.appendChild(quoteNode);

-        divToInsert = document.createElement('div');

-        parentSpan = document.createElement('span');

-        parentSpan.setAttribute('class', 'c2');

-        childSpan = document.createElement('span');

-        parentSpan.appendChild(childSpan);

-        document.documentElement.appendChild(parentSpan);

-        setTimeout('endTest(childSpan);', 50);

-        if (window.layoutTestController) {

-            layoutTestController.waitUntilDone();

-            layoutTestController.dumpAsText();

-        }

-    }

-    window.onload = startTest;

-</script>

diff --git a/tests/tests/webkitsecurity/assets/inline-text-destroy-attributes-crash.xhtml b/tests/tests/webkitsecurity/assets/inline-text-destroy-attributes-crash.xhtml
deleted file mode 100644
index e00e61c..0000000
--- a/tests/tests/webkitsecurity/assets/inline-text-destroy-attributes-crash.xhtml
+++ /dev/null
@@ -1,22 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>

-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">

-<defs>

-    <text id="text1">

-        <tspan id="tspan1" x="906" y="250">Test passes it if does not crash</tspan>

-        <tspan id="tspan2" x="447" y="108">PASS</tspan>

-    </text>

-</defs>

-<use id="use1" xlink:href="#text1"/>

-<text id="text2"></text>

-<script>

-    if (window.layoutTestController)

-	    layoutTestController.dumpAsText();

-

-    var range = document.createRange();

-    range.setStart(document.getElementById("use1"), 0);

-    range.setEnd(document.getElementById("text2"), 0);

-    (new XMLSerializer()).serializeToString(range.extractContents());

-	document.getElementById('text1').offsetTop;

-    range.surroundContents(document.getElementById("tspan1"));

-</script>

-</svg>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/inline-to-block-crash.html b/tests/tests/webkitsecurity/assets/inline-to-block-crash.html
deleted file mode 100644
index d4c8081..0000000
--- a/tests/tests/webkitsecurity/assets/inline-to-block-crash.html
+++ /dev/null
@@ -1,43 +0,0 @@
-<script>
-
-// This tests a particular sequence of render tree changes, which
-// caused a crash in the code that maintains the line box tree.
-// Even small changes to the test make it no longer crash, so it
-// should be left as-is. That's why the test results don't say
-// anything about what this tests -- adding that caused the crash
-// to go away!
-
-function turnAnchorIntoBlock()
-{
-    document.getElementById("a").style.display = "block";
-    document.getElementById("span").firstChild.data = "PASSED";
-    if (window.layoutTestController)
-        layoutTestController.notifyDone();
-}
-
-function turnSpanIntoBlock()
-{
-    document.body.offsetHeight; // trigger layout
-    document.getElementById("span").style.display = "block";
-    
-    setTimeout(turnAnchorIntoBlock, 0);
-}
-
-function runTest()
-{
-    if (window.layoutTestController) {
-        layoutTestController.dumpAsText();
-        layoutTestController.waitUntilDone();
-    }
-    setTimeout(turnSpanIntoBlock, 0);
-}
-
-</script>
-
-<body onload="runTest()">
-
-<a id="a">
-    <span id="span">TEST HAS NOT RUN YET</span>
-</a>
-
-</body>
diff --git a/tests/tests/webkitsecurity/assets/innerHTML-script-tag-crash.xhtml b/tests/tests/webkitsecurity/assets/innerHTML-script-tag-crash.xhtml
deleted file mode 100644
index 3cfaf05..0000000
--- a/tests/tests/webkitsecurity/assets/innerHTML-script-tag-crash.xhtml
+++ /dev/null
@@ -1,19 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-    <script>
-        <![CDATA[
-            if (window.layoutTestController)
-                layoutTestController.dumpAsText();
-
-            var span = document.createElement("span");
-            document.documentElement.appendChild(span);
-            span.outerHTML = "<sc"+"ript></scr"+"ipt>";
-        ]]>
-    </script>
-</head>
-<body>
-    <p>This tests a crash in the xml parser when using innerHTML or outerHTML to insert a script tag into a xhtml 
-       document. (rdar://problem/5519698).  The test has passed if it does not crash.</p>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/innerHTML-selection-crash.html b/tests/tests/webkitsecurity/assets/innerHTML-selection-crash.html
deleted file mode 100644
index 9ff249b..0000000
--- a/tests/tests/webkitsecurity/assets/innerHTML-selection-crash.html
+++ /dev/null
@@ -1,20 +0,0 @@
-<p>This tests that calling innerHTML doesn't crash when the selection endpoint is inside a text field's shadow DOM tree.</p>
-
-<p>If the test doesn't crash, then it passes.</p>
-
-<input id="field" type="text" value="some text">
-<script>
-
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-document.getElementById('field').setAttribute('style', 'display: inline');
-document.getElementById('field').focus();
-document.body.offsetLeft;
-document.getElementById('field').setAttribute('style', 'display: block');
-document.body.innerHTML;
-document.getElementById('field').setAttribute('style', 'display: none');
-
-document.write("<p>PASS: There was no crash.</p>");
-
-</script>
diff --git a/tests/tests/webkitsecurity/assets/input-box-text-fragment-combine-text-crash.html b/tests/tests/webkitsecurity/assets/input-box-text-fragment-combine-text-crash.html
deleted file mode 100644
index 3a4e689..0000000
--- a/tests/tests/webkitsecurity/assets/input-box-text-fragment-combine-text-crash.html
+++ /dev/null
@@ -1,11 +0,0 @@
-<html>

-Test passes if it does not crash.

-<input type="submit" value="Search"></input>

-<style>

-    input { -webkit-text-combine:horizontal; }

-</style>

-<script>

-    if (window.layoutTestController)

-        layoutTestController.dumpAsText();

-</script>

-</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/input-element-attach-crash.html b/tests/tests/webkitsecurity/assets/input-element-attach-crash.html
deleted file mode 100644
index 318731b..0000000
--- a/tests/tests/webkitsecurity/assets/input-element-attach-crash.html
+++ /dev/null
@@ -1,20 +0,0 @@
-<html>
-    <head>
-        <script>
-            if (window.layoutTestController)
-                layoutTestController.dumpAsText();
-        </script>
-    </head>
-    <body>
-        <button autofocus>
-            <object>
-                <select autofocus>
-                <input>
-                <span>
-                <div></div>
-                PASS
-            </object>
-            <object></object>
-        </button>
-    </body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/input-element-page-cache-crash.html b/tests/tests/webkitsecurity/assets/input-element-page-cache-crash.html
deleted file mode 100644
index 891d941..0000000
--- a/tests/tests/webkitsecurity/assets/input-element-page-cache-crash.html
+++ /dev/null
@@ -1,55 +0,0 @@
-<html>
-<head>
-<script>
-
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-    layoutTestController.overridePreference("WebKitUsesPageCachePreferenceKey", 1);
-}
-
-function runTest()
-{
-    var input = document.getElementById("testinput");
-    input.setAttribute("autocomplete", "on");
-    input.parentNode.removeChild(input);
-
-    // Location changes need to happen outside the onload handler to generate history entries.
-    setTimeout(function() {window.location = "data:text/html,<script>history.back();</scrip" + "t>";}, 0);
-}
-
-function pageHidden()
-{
-    if (!sessionStorage.finishTest) {
-        console.log('navigating away');
-        sessionStorage.finishTest = true;
-    } else {
-        // Clean up after ourselves
-        delete sessionStorage.finishTest;
-    }
-}
-
-function pageShown()
-{
-    if (sessionStorage.finishTest) {
-        console.log('navigated back');
-        if (window.layoutTestController)
-            layoutTestController.notifyDone();
-    } else {
-        runTest();
-    }
-}
-
-</script>    
-</head>
-
-<body onpagehide="pageHidden();" onpageshow="pageShown();">
-<pre>This test has an input element that starts out with autocomplete=off.
-It then changes autocomplete to on.
-It then removes the element so it is destroyed.
-It then navigates to a new page, placing the current page in the page cache.
-Finally it returns to the original page.</pre>
-<form>
-<input id="testinput" autocomplete="off">
-</form>
-</body>
diff --git a/tests/tests/webkitsecurity/assets/input-number-crash.html b/tests/tests/webkitsecurity/assets/input-number-crash.html
deleted file mode 100644
index 3086af8..0000000
--- a/tests/tests/webkitsecurity/assets/input-number-crash.html
+++ /dev/null
@@ -1,26 +0,0 @@
-<html>
-    <head>
-        <script>
-            function test()
-            {
-                if (window.layoutTestController)
-                    layoutTestController.dumpAsText();
-                var input = document.getElementById("test");
-                var x = input.offsetLeft + input.offsetWidth - 8;
-                var y = input.offsetTop + input.offsetHeight - 7;
-                if (window.eventSender) {
-                    eventSender.mouseMoveTo(x, y);
-                    eventSender.mouseDown();
-                    eventSender.mouseUp();
-                }
-            }
-        </script>
-        <style>
-            #test { width: 100px; }
-        </style>
-    </head>
-    <body onload="test()">
-        This tests that we don't crash when the renderer goes away during event handling.<br>
-        <input type="number" id="test" onclick="event.target.style.display='none'">
-    </body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/input-number-spinbutton-crash.html b/tests/tests/webkitsecurity/assets/input-number-spinbutton-crash.html
deleted file mode 100644
index fbda964..0000000
--- a/tests/tests/webkitsecurity/assets/input-number-spinbutton-crash.html
+++ /dev/null
@@ -1,21 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<style>
-input::-webkit-inner-spin-button { display: none; }
-</style>
-</head>
-<body>
-<input type="number" id="in">
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-var input = document.getElementById('in');
-var evt = document.createEvent("MouseEvent");
-evt.initMouseEvent("click", true, true, window, 10, 10, 10, 10);
-input.dispatchEvent(evt);
-input.style.display='none';
-</script>
-PASS
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/input-search-table-column-crash.html b/tests/tests/webkitsecurity/assets/input-search-table-column-crash.html
deleted file mode 100644
index dc29ccf..0000000
--- a/tests/tests/webkitsecurity/assets/input-search-table-column-crash.html
+++ /dev/null
@@ -1,14 +0,0 @@
-<html>
-    <script>
-        if (window.layoutTestController)
-            layoutTestController.dumpAsText();
-    </script>
-    <style>
-        input[type="search"]::-webkit-search-cancel-button {
-            -webkit-appearance: none; 
-            display: table-column;
-        }
-    </style>
-    <input type="search">
-    PASS
-</html>
diff --git a/tests/tests/webkitsecurity/assets/insert-images-in-pre-x-crash.html b/tests/tests/webkitsecurity/assets/insert-images-in-pre-x-crash.html
deleted file mode 100644
index a1c6fdb..0000000
--- a/tests/tests/webkitsecurity/assets/insert-images-in-pre-x-crash.html
+++ /dev/null
@@ -1,21 +0,0 @@
-<pre id="x"><x style="white-space: pre-wrap;"><br></x></pre>
-<script>
-
-// Adding DOCTYPE, html, or body prevents the crash to reproduce.
-
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-var x = document.getElementById("x");
-document.execCommand("selectall",false);
-document.designMode="on";
-document.execCommand("InsertImage");
-document.execCommand("InsertImage");
-document.execCommand("InsertImage");
-
-document.open();
-document.writeln('This test ensures WebKit does not crash.<br><br>PASS');
-
-</script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/insert-text-crash.html b/tests/tests/webkitsecurity/assets/insert-text-crash.html
deleted file mode 100644
index 7810e8e..0000000
--- a/tests/tests/webkitsecurity/assets/insert-text-crash.html
+++ /dev/null
@@ -1,20 +0,0 @@
-<style>
-#el2 {
-    display: -webkit-flexbox;
-    border: 1px solid red;
-}
-#el3 {
-    position: absolute;
-    border: 1px solid green;
-}
-</style>
-<body contenteditable=true>
-<div id="el2"><div id="el3">AA </div></div>
-</body>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-document.execCommand('selectall')
-document.execCommand('inserttext', '')
-document.body.innerText = "This test passes if it does not crash.";
-</script>
diff --git a/tests/tests/webkitsecurity/assets/insert-text-into-empty-frameset-crash.html b/tests/tests/webkitsecurity/assets/insert-text-into-empty-frameset-crash.html
deleted file mode 100644
index f539969..0000000
--- a/tests/tests/webkitsecurity/assets/insert-text-into-empty-frameset-crash.html
+++ /dev/null
@@ -1,19 +0,0 @@
-<!DOCTYPE html>
-<script>
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-}
-
-setTimeout(function() {
-    document.designMode="on";
-    document.execCommand("selectall");
-    document.execCommand("InsertText", false);
-    document.open();
-    document.write("This test ensures that selecting all and inserting text into a page with a frameset does not crash<br><br>PASS");
-    if (window.layoutTestController)
-        layoutTestController.notifyDone();
-}, 0);
-</script>
-<frameset><frame></frame></frameset>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/insertAdjacentHTML-DocumentFragment-crash.html b/tests/tests/webkitsecurity/assets/insertAdjacentHTML-DocumentFragment-crash.html
deleted file mode 100644
index 3efa325..0000000
--- a/tests/tests/webkitsecurity/assets/insertAdjacentHTML-DocumentFragment-crash.html
+++ /dev/null
@@ -1,10 +0,0 @@
-This test passes if it doesn't crash (or ASSERT).
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-var f = document.createDocumentFragment();
-var s = document.createElement('div');
-f.appendChild(s);
-s.insertAdjacentHTML('afterend', "aaa");
-</script>
diff --git a/tests/tests/webkitsecurity/assets/insertHTML-mutation-crash.html b/tests/tests/webkitsecurity/assets/insertHTML-mutation-crash.html
deleted file mode 100644
index d46e6b3..0000000
--- a/tests/tests/webkitsecurity/assets/insertHTML-mutation-crash.html
+++ /dev/null
@@ -1,45 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-    <script type="text/javascript">
-        function log(msg)
-        {
-            document.body.appendChild(document.createTextNode(msg + '\n'));
-        }
-
-        function runTests()
-        {
-            if (window.layoutTestController)
-                layoutTestController.dumpAsText();
-
-            var listener = function(e) {
-                var el = document.getElementById('cont');
-                if (el.firstElementChild && el.lastElementChild != el.firstElementChild) {
-                    el.lastElementChild.appendChild(el.firstElementChild);
-                    el.lastElementChild && el.removeChild(el.lastElementChild);
-                }
-                if (e.target.firstChild && e.target.firstChild.className == 'Apple-style-span')
-                    e.target.firstChild.innerHTML = e.target.firstChild.innerHTML.split(' ')[0];
-            };
-            document.addEventListener("DOMSubtreeModified", listener);
-
-            var el = document.getElementById('cont');
-            window.getSelection().setBaseAndExtent(document.getElementById('start'), 0, document.getElementById('end'), 0);
-            var str = '<span class="Apple-style-span" style="color: red;"><span>styled</span> <span>content</span></span>';
-            document.execCommand("InsertHTML", false, str);
-
-            document.removeEventListener("DOMSubtreeModified", listener);
-
-            log('PASS: No crash.');
-        }
-
-    </script>
-</head>
-<body onload="runTests();">
-    <div id="cont" contenteditable="true">
-        <span>This <span id="start">tests</span></span>
-        <span>that we don't crash when <code id="end">mutating</code> the dom</span>
-        <span>during execution of an InsertHTML command.</span>
-    </div>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/insertNode-empty-fragment-crash.html b/tests/tests/webkitsecurity/assets/insertNode-empty-fragment-crash.html
deleted file mode 100644
index 7ec617c..0000000
--- a/tests/tests/webkitsecurity/assets/insertNode-empty-fragment-crash.html
+++ /dev/null
@@ -1,38 +0,0 @@
-<html>
-    <head>
-        <script src="../../js/resources/js-test-pre.js"></script>
-    </head>
-    <body>
-        <script>
-            description('Test Range.insertNode(fragment) when the fragment is empty and the range is collapsed');
-
-            var p = document.createElement('p');
-            var t1 = document.createTextNode('12345');
-            p.appendChild(t1);
-            var t2 = document.createTextNode('ABCDE');
-            p.appendChild(t2);
-            document.body.appendChild(p);
-            var r = document.createRange();
-            r.setStart(p, 1);
-            r.setEnd(p, 1);
-            shouldBeEqualToString("r.toString()", "");
-
-            var df = document.createDocumentFragment();
-            r.insertNode(df);
-
-            shouldBe("p.childNodes.length", "2");
-            shouldBe("p.childNodes[0]", "t1");
-            shouldBe("p.childNodes[1]", "t2");
-
-            shouldBeTrue("r.collapsed");
-            shouldBe("r.startContainer", "p");
-            shouldBe("r.startOffset", "1");
-            shouldBe("r.endContainer", "p");
-            shouldBe("r.endOffset", "1");
-            shouldBeEqualToString("r.toString()", "")
-
-            document.body.removeChild(p);
-        </script>
-        <script src="../../js/resources/js-test-post.js"></script>
-    </body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/insertion-point-line-number-on-password-crashes.html b/tests/tests/webkitsecurity/assets/insertion-point-line-number-on-password-crashes.html
deleted file mode 100644
index 6b7581c..0000000
--- a/tests/tests/webkitsecurity/assets/insertion-point-line-number-on-password-crashes.html
+++ /dev/null
@@ -1,25 +0,0 @@
-<html>
-<script>
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-</script>
-<body>
-
-    <div id="result"></div>
-
-    <input type="password" id="password">
-
-    <script>
-        if (window.accessibilityController) {
-            var result = document.getElementById("result");
-
-            var password = document.getElementById("password");
-            password.focus();
-
-            // Make sure this doesn't crash.
-            lineNumber = accessibilityController.focusedElement.insertionPointLineNumber;
-            result.innerText += "Line number for password element: " + lineNumber + "\n";
-        }
-    </script>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/interactive-validation-crash-by-style-override.html b/tests/tests/webkitsecurity/assets/interactive-validation-crash-by-style-override.html
deleted file mode 100644
index c6019ec..0000000
--- a/tests/tests/webkitsecurity/assets/interactive-validation-crash-by-style-override.html
+++ /dev/null
@@ -1,31 +0,0 @@
-<!DOCTYPE html>
-<head>
-<script src="../js/resources/js-test-pre.js"></script>
-<style type="text/css">
-div {
-    position: relative;
-}
-</style>
-</head>
-<body>
-<form>
-  <select required>
-    <option value="">X</option>
-    <option>Y</option>
-  </select>
-  <input type=submit id="submit">
-</form>
-
-<div id=console></div>
-
-<script>
-document.getElementById('submit').click();
-setTimeout(function () {
-    document.getElementsByTagName('select')[0].selectedIndex = 1;
-    testPassed('Not crashed');
-    finishJSTest();
-}, 0);
-window.jsTestIsAsync = true;
-</script>
-<script src="../js/resources/js-test-post.js"></script>
-</body>
diff --git a/tests/tests/webkitsecurity/assets/interactive-validation-select-crash.html b/tests/tests/webkitsecurity/assets/interactive-validation-select-crash.html
deleted file mode 100644
index a82b052..0000000
--- a/tests/tests/webkitsecurity/assets/interactive-validation-select-crash.html
+++ /dev/null
@@ -1,33 +0,0 @@
-<!DOCTYPE html>
-<head>
-<script src="../js/resources/js-test-pre.js"></script>
-</head>
-<body>
-<p>Test for a bug that RenderBlock crashed when a validation message bubble for a select element with float:left was closing.</p>
-<div id=console></div>
-<form>
-<select style="float:left" required>
-<option value="">Plese select</option>
-<option>Foo</option>
-</select>
-<input type=submit id=submit>
-</form>
-
-<script>
-window.jsTestIsAsync = true;
-
-function closeBubble() {
-    // Make the <select> valid to close the validation message bubble.
-    document.getElementsByTagName('select')[0].selectedIndex = 1;
-    setTimeout(finish, 0);
-}
-function finish() {
-    testPassed('Not crashed.');
-    finishJSTest();
-}
-
-document.getElementById('submit').click();
-setTimeout(closeBubble, 0);
-</script>
-<script src="../js/resources/js-test-post.js"></script>
-</body>
diff --git a/tests/tests/webkitsecurity/assets/invalid-charset-on-script-crashes-loader.html b/tests/tests/webkitsecurity/assets/invalid-charset-on-script-crashes-loader.html
deleted file mode 100644
index 32e32f9..0000000
--- a/tests/tests/webkitsecurity/assets/invalid-charset-on-script-crashes-loader.html
+++ /dev/null
@@ -1,2 +0,0 @@
-<title>Testcase for 6345</title>
-<script type="text/javascript" src="resources/invalid-charset-on-script-crashes-loader.js" charset="invalid-encoding-name"></script>
diff --git a/tests/tests/webkitsecurity/assets/invalid-charset-on-script-crashes-loader.js b/tests/tests/webkitsecurity/assets/invalid-charset-on-script-crashes-loader.js
deleted file mode 100644
index 044c0c5..0000000
--- a/tests/tests/webkitsecurity/assets/invalid-charset-on-script-crashes-loader.js
+++ /dev/null
@@ -1,3 +0,0 @@
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-document.writeln("Success!");
diff --git a/tests/tests/webkitsecurity/assets/invalid-color-crash.svg b/tests/tests/webkitsecurity/assets/invalid-color-crash.svg
deleted file mode 100644
index bdb85ed..0000000
--- a/tests/tests/webkitsecurity/assets/invalid-color-crash.svg
+++ /dev/null
@@ -1,16 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http:/xlink">

-    <script>

-        <![CDATA[

-            if (window.layoutTestController)

-                layoutTestController.dumpAsText();

-        ]]>

-    </script>

-    <style type="text/css">

-        svg 

-        {

-            stop-color: initial;

-        }

-    </style>

-    <text id="myText1" fill="green" x="0" y="0">PASS</text>

-</svg>

-

diff --git a/tests/tests/webkitsecurity/assets/invalid-cursor-property-crash.html b/tests/tests/webkitsecurity/assets/invalid-cursor-property-crash.html
deleted file mode 100644
index c768564..0000000
--- a/tests/tests/webkitsecurity/assets/invalid-cursor-property-crash.html
+++ /dev/null
@@ -1,21 +0,0 @@
-<html>
-<head>
-    <script>
-    function runTest() {
-        if (window.layoutTestController)
-            layoutTestController.dumpAsText();
-            
-        var d = document.getElementById('theDiv');
-        var style = document.defaultView.getComputedStyle(d, '');
-        
-        if (style && style.cursor == 'url(' + document.location + '), auto')
-            document.getElementById('result').innerHTML = 'SUCCESS';            
-    }
-    </script>
-</head>
-<body onload="runTest()">
-<div id="theDiv" style="cursor: url()">
-<div>This tests that the invalid cursor property value does not get applied. See Bug 11221.</div>
-<div id="result">FAILURE</div>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/invalid-font-family-in-font-face-crash.html b/tests/tests/webkitsecurity/assets/invalid-font-family-in-font-face-crash.html
deleted file mode 100644
index 6003f48..0000000
--- a/tests/tests/webkitsecurity/assets/invalid-font-family-in-font-face-crash.html
+++ /dev/null
@@ -1,14 +0,0 @@
-<html>

-Test passes if it does not crash.

-<style>

-    @font-face { font-family: inherit; }

-	

-	@font-face { font-family: initial; }

-</style>

-<script>

-    if (window.layoutTestController)

-	    layoutTestController.dumpAsText();

-		

-	document.body.offsetTop;

-</script>

-</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/invalid-media-url-crash.html b/tests/tests/webkitsecurity/assets/invalid-media-url-crash.html
deleted file mode 100644
index 42540b7..0000000
--- a/tests/tests/webkitsecurity/assets/invalid-media-url-crash.html
+++ /dev/null
@@ -1,32 +0,0 @@
-<html>
-    <body>
-        <p>Tests that invalid media src url does not result in crash.</p>
-        <script src=video-test.js></script>
-        <script>
-            var invalid_url = "!:/" + String.fromCharCode(0) + "%aa#aa";
-            var error_count = 0;
-
-            function errorEvent()
-            {
-                error_count++;
-                if (error_count == 2)
-                {
-                    testExpected("audio.error.code", MediaError.MEDIA_ERR_SRC_NOT_SUPPORTED);
-                    testExpected("video.error.code", MediaError.MEDIA_ERR_SRC_NOT_SUPPORTED);
-                    testExpected("audio.networkState", HTMLMediaElement.NETWORK_NO_SOURCE);
-                    testExpected("video.networkState", HTMLMediaElement.NETWORK_NO_SOURCE);
-                    endTest();
-                }
-            }
-
-            var audio = document.createElement('audio');
-            var video = document.createElement('video');
-            audio.src = invalid_url;
-            video.src = invalid_url;
-            audio.onerror = errorEvent;
-            video.onerror = errorEvent;
-            document.body.appendChild(audio);
-            document.body.appendChild(video);
-        </script>
-    </body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/invalid-set-font-crash.html b/tests/tests/webkitsecurity/assets/invalid-set-font-crash.html
deleted file mode 100644
index 1e04bf7..0000000
--- a/tests/tests/webkitsecurity/assets/invalid-set-font-crash.html
+++ /dev/null
@@ -1,19 +0,0 @@
-<html>
-<head>
-    <script type="text/javascript">
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    function init()
-    {
-        var ctx = document.getElementById("canvas").getContext("2d");
-        ctx.font = "font-family: Helvetica; font-size: 48pt; font-color: #000000";
-        ctx.fillText("Hello world", 10, 200);
-    }
-    </script>
-</head>
-<body onload="init()">
-    <p>This test should not crash.</p>
-    <canvas id="canvas" height="300" width="300"></canvas>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/jQuery-animation-crash.html b/tests/tests/webkitsecurity/assets/jQuery-animation-crash.html
deleted file mode 100644
index 2699c0b..0000000
--- a/tests/tests/webkitsecurity/assets/jQuery-animation-crash.html
+++ /dev/null
@@ -1,58 +0,0 @@
-<p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=25381">bug 25381</a>:
-jQuery animation crashing Safari.</p>
-<p>PASS if didn't crash.</p>
-<div style="position:fixed; top:0px; width:100px; background:red;">
-    <div id="i" style="position:fixed; display:none; top:0px; width:100px; height:100px; overflow:hidden; background:green;"><div>ABC</div></div>
-</div>
-
-<script>
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.waitUntilDone();
-}
-
-function swap( elem, options, callback ) {
-    var old = {};
-    // Remember the old values, and insert the new ones
-    for ( var name in options ) {
-        old[ name ] = elem.style[ name ];
-        elem.style[ name ] = options[ name ];
-    }
-
-    callback.call( elem );
-
-    // Revert the old values
-    for ( var name in options ) {
-        elem.style[ name ] = old[ name ];
-    }
-}
-
-function forceLayout()
-{
-    document.body.offsetTop;
-}
-
-setTimeout(function() {
-    var elem = document.getElementById('i');
-    elem.style['display']='block';
-
-    var val, props = { position: "absolute", visibility: "hidden", display:"block" }; 
-    function getWH() {
-        val = elem.offsetHeight;
-    }
-    swap( elem, props, getWH );
-
-    forceLayout();
-    elem.style['height']=2;
-    forceLayout();
-    elem.style['height']=3;
-    forceLayout();
-    elem.style['display']='none';
-    forceLayout();
-    if (window.layoutTestController)
-        layoutTestController.notifyDone();
-    return;
-}, 0); 
-
-</script>
-
diff --git a/tests/tests/webkitsecurity/assets/javascript-url-as-framesrc-crash.html b/tests/tests/webkitsecurity/assets/javascript-url-as-framesrc-crash.html
deleted file mode 100644
index a0da5be..0000000
--- a/tests/tests/webkitsecurity/assets/javascript-url-as-framesrc-crash.html
+++ /dev/null
@@ -1,21 +0,0 @@
-<head>

-<script language="JavaScript">

-// See https://bugs.webkit.org/show_bug.cgi?id=26230

-

-if (window.layoutTestController) {

-    layoutTestController.dumpAsText();

-}

-

-function makeFrameContents() {

-    var doc = theFrame.document;

-    doc.open();

-    doc.write('<img src=no-image-resource-required.png>');

-    doc.close();

-    return "SUCCESS (as long as we didn't crash, claim victory)";

-}

-</script>

-</head>

-

-<frameset>

-    <frame name="theFrame" src="javascript:parent.makeFrameContents()">

-</frameset>

diff --git a/tests/tests/webkitsecurity/assets/javascript-url-crash-function-iframe.html b/tests/tests/webkitsecurity/assets/javascript-url-crash-function-iframe.html
deleted file mode 100644
index 2fca7f8..0000000
--- a/tests/tests/webkitsecurity/assets/javascript-url-crash-function-iframe.html
+++ /dev/null
@@ -1,22 +0,0 @@
-<script>
-function test()
-{
-    (function ()
-    {
-        (function ()
-        {
-            (function ()
-            {
-                frameElement.src = "javascript:'<pre>PASS: You didn\\'t crash.</pre>'";
-            })()
-        })()
-    })()
-}
-
-setTimeout(function ()
-{
-    test();
-    if (window.layoutTestController)
-        layoutTestController.notifyDone();
-}, 0);
-</script>
diff --git a/tests/tests/webkitsecurity/assets/javascript-url-crash-function.html b/tests/tests/webkitsecurity/assets/javascript-url-crash-function.html
deleted file mode 100644
index 2dcc16a..0000000
--- a/tests/tests/webkitsecurity/assets/javascript-url-crash-function.html
+++ /dev/null
@@ -1,14 +0,0 @@
-<p>
-This page tests whether loading a javascript: URL into an iframe while the
-iframe is calling a JavaScript function causes a crash.
-</p>
-
-<iframe src="resources/javascript-url-crash-function-iframe.html"></iframe>
-
-<script>
-if (window.layoutTestController) {
-    layoutTestController.dumpAsText();
-    layoutTestController.dumpChildFramesAsText();
-    layoutTestController.waitUntilDone();
-}
-</script>
diff --git a/tests/tests/webkitsecurity/assets/javascript-url-iframe-crash.html b/tests/tests/webkitsecurity/assets/javascript-url-iframe-crash.html
deleted file mode 100644
index 47fd0ca..0000000
--- a/tests/tests/webkitsecurity/assets/javascript-url-iframe-crash.html
+++ /dev/null
@@ -1,10 +0,0 @@
-<html>
-<script>
-    if (window.layoutTestController) {
-        layoutTestController.dumpAsText();
-        layoutTestController.waitUntilDone();
-    }
-    
-    window.location="resources/javascript-url-iframe-crash.webarchive";
-</script>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/javascript-url-iframe-crash.webarchive b/tests/tests/webkitsecurity/assets/javascript-url-iframe-crash.webarchive
deleted file mode 100644
index 07c478d..0000000
--- a/tests/tests/webkitsecurity/assets/javascript-url-iframe-crash.webarchive
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/keyboardevent-mousedown-crash.html b/tests/tests/webkitsecurity/assets/keyboardevent-mousedown-crash.html
deleted file mode 100644
index 38b1788..0000000
--- a/tests/tests/webkitsecurity/assets/keyboardevent-mousedown-crash.html
+++ /dev/null
@@ -1,21 +0,0 @@
-<html>
-    <body>
-        <div id="test"></div>
-        <div id="result"></div> 
-        <script>
-            if (window.layoutTestController)
-            {
-                layoutTestController.dumpAsText();
-                layoutTestController.waitUntilDone();
-            }
-
-            var event = document.createEvent('KeyboardEvent');
-            event.initEvent('mousedown', true, true);
-            document.getElementById('test').dispatchEvent(event);
-
-            document.getElementById('result').innerHTML = "PASS";
-            if (window.layoutTestController)
-                layoutTestController.notifyDone();
-        </script> 
-    </body> 
-</html>
diff --git a/tests/tests/webkitsecurity/assets/keyevent-iframe-removed-crash.html b/tests/tests/webkitsecurity/assets/keyevent-iframe-removed-crash.html
deleted file mode 100644
index 01f81f3..0000000
--- a/tests/tests/webkitsecurity/assets/keyevent-iframe-removed-crash.html
+++ /dev/null
@@ -1,42 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<script>
-    function go() {
-        var fr = document.createElement('iframe');
-        fr.id = "blorp";
-        document.body.appendChild(fr);
-        fr.contentDocument.body.innerHTML = '<p id="a">move mouse out of the window, and press a key</p>';
-        fr.contentDocument.body.onkeydown = function(e) {
-            e.preventDefault();
-            document.body.removeChild(fr);
-        };
-
-        fr.focus();
-
-        if (window.layoutTestController)
-        {
-            layoutTestController.dumpAsText();
-            layoutTestController.waitUntilDone();
-            setTimeout(nuke, 0);
-        }
-    }
-
-    function nuke() {
-        eventSender.keyDown("x")
-        layoutTestController.notifyDone();
-    }
-</script>
-</head>
-
-<body onload="go()">
-    <p>
-        This test passes if it does not crash. Move the mouse out
-        of the window, and then press any key.
-    </p>
-
-    <p>
-        PASS
-    </p>
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/khmer-crash.html b/tests/tests/webkitsecurity/assets/khmer-crash.html
deleted file mode 100644
index df4badd..0000000
--- a/tests/tests/webkitsecurity/assets/khmer-crash.html
+++ /dev/null
@@ -1,21 +0,0 @@
-<!DOCTYPE html>
-<html dir="ltr" lang="km">
-<head>
-<meta charset="UTF-8" />
-<title>តូបសៀវភៅ | ប្រឆាំង​នឹង​ភាព​ល្ងង់​ខ្លៅ​</title>
-</head>
-  <div>This test checks that rendering of Khmer text does not crash.  The test
-  passes if it does not crash.</div>
-  <div id="site-description">ប្រឆាំង​នឹង​ភាព​ល្ងង់​ខ្លៅ​</div>
-</body>
-
-<script>
-function runTest() {
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-    var div = document.getElementById("site-description");
-    window.getSelection().setBaseAndExtent(div, 0, div, 1);
-}
-runTest();
-</script>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/large-list-of-rules-crash.css b/tests/tests/webkitsecurity/assets/large-list-of-rules-crash.css
deleted file mode 100644
index 077f6dd..0000000
--- a/tests/tests/webkitsecurity/assets/large-list-of-rules-crash.css
+++ /dev/null
@@ -1 +0,0 @@
-a {}
diff --git a/tests/tests/webkitsecurity/assets/large-list-of-rules-crash.html b/tests/tests/webkitsecurity/assets/large-list-of-rules-crash.html
deleted file mode 100644
index d48dff4..0000000
--- a/tests/tests/webkitsecurity/assets/large-list-of-rules-crash.html
+++ /dev/null
@@ -1,27 +0,0 @@
-<!DOCTYPE HTML PUBLIC
-  "-//W3C//DTD HTML 4.01//EN"
-  "http://www.w3.org/TR/html4/strict.dtd">
-
-<script type="text/javascript">
-var array = Array(200000);
-for (var i = 0; i < 200000; ++i)
-    array[i] = "a {}\n";
-var s = array.join("");
-
-var style = document.createElement("style");
-style.appendChild(document.createTextNode(s));
-document.getElementsByTagName("head")[0].appendChild(style);
-
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
-
-<!-- loading a linked style sheet causes the list of CSS Rules to be rebuilt,
-     which caused a crash (stack overflow) -->
-<link rel="stylesheet" href="resources/large-list-of-rules-crash.css">
-<link rel="stylesheet" href="resources/large-list-of-rules-crash.css">
-
-<p>Test case for
-<a href="https://bugs.webkit.org/show_bug.cgi?id=27748"
-   >https://bugs.webkit.org/show_bug.cgi?id=27748</a>. If the browser did
-   not crash, the test passed.</p>
diff --git a/tests/tests/webkitsecurity/assets/large-rowspan-crash.html b/tests/tests/webkitsecurity/assets/large-rowspan-crash.html
deleted file mode 100644
index 26fc5ba..0000000
--- a/tests/tests/webkitsecurity/assets/large-rowspan-crash.html
+++ /dev/null
@@ -1,6 +0,0 @@
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-</script>
-<table><td rowspan=674227123></td></table>
-<p>If the browser didn't crash, the test passed.</p>
diff --git a/tests/tests/webkitsecurity/assets/large-size-image-crash.html b/tests/tests/webkitsecurity/assets/large-size-image-crash.html
deleted file mode 100644
index fa32d5f..0000000
--- a/tests/tests/webkitsecurity/assets/large-size-image-crash.html
+++ /dev/null
@@ -1,13 +0,0 @@
-<html>

-    <head>

-        <script>

-            if (window.layoutTestController)

-                layoutTestController.dumpAsText();

-        </script>

-    </head>

-    <body>

-        <img src="resources/large-size-image-crash.jpeg">

-        <p>PASS</p>

-    </body>

-</html>

-

diff --git a/tests/tests/webkitsecurity/assets/large-size-image-crash.jpeg b/tests/tests/webkitsecurity/assets/large-size-image-crash.jpeg
deleted file mode 100644
index 9e97147..0000000
--- a/tests/tests/webkitsecurity/assets/large-size-image-crash.jpeg
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/layer-hit-test-crash-expected.png b/tests/tests/webkitsecurity/assets/layer-hit-test-crash-expected.png
deleted file mode 100644
index 66cd3a8..0000000
--- a/tests/tests/webkitsecurity/assets/layer-hit-test-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/layer-hit-test-crash.html b/tests/tests/webkitsecurity/assets/layer-hit-test-crash.html
deleted file mode 100644
index 81a0a02..0000000
--- a/tests/tests/webkitsecurity/assets/layer-hit-test-crash.html
+++ /dev/null
@@ -1,56 +0,0 @@
-<html>
-<head>
-<script>
-
-if (window.layoutTestController)
-    layoutTestController.waitUntilDone();
-
-function test()
-{
-    window.setTimeout('removeChildLayer()', 0);
-}
-
-function removeChildLayer()
-{
-    // force a layout
-    x = document.getElementById('remove').clientX;
-
-    if (window.eventSender) {
-        eventSender.mouseMoveTo(100, 100);
-        eventSender.mouseDown();
-    }
-
-    document.getElementById('remove').style.visibility = "hidden";
-    window.setTimeout('moveMouse()', 0);
-}
-
-function moveMouse()
-{
-    if (window.eventSender)
-        eventSender.mouseMoveTo(100, 100);
-    window.setTimeout('finish()', 0);
-}
-
-function finish()
-{
-    if (window.eventSender)
-        eventSender.mouseUp();
-    if (window.layoutTestController)
-        layoutTestController.notifyDone();
-}
-
-</script>
-</head>
-
-<body onload="test();">
-<div>Mousing over the yellow square below should not cause an
-assertion failure or crash. This tests for regressions against
-<a href="https://bugs.webkit.org/show_bug.cgi?id=6931">6931</a>.
-
-</div>
-<div style="background: yellow; position: absolute; z-index: 1; top: 50; left: 50; width: 200; height: 200">
-<div id="remove" style="z-index: 5; background: red; position: absolute; top: 0; left: 20; width: 100; height: 100">
-</div>
-</div>
-</body>
-</body>
diff --git a/tests/tests/webkitsecurity/assets/layerZOrderCrash-expected.png b/tests/tests/webkitsecurity/assets/layerZOrderCrash-expected.png
deleted file mode 100644
index 419d4bf..0000000
--- a/tests/tests/webkitsecurity/assets/layerZOrderCrash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/layerZOrderCrash.html b/tests/tests/webkitsecurity/assets/layerZOrderCrash.html
deleted file mode 100644
index e2ee631..0000000
--- a/tests/tests/webkitsecurity/assets/layerZOrderCrash.html
+++ /dev/null
@@ -1,48 +0,0 @@
-<html>
-<head>
-<style type="text/css">
-html, table {
-position: relative;
-}
-</style>
-</head>
-
-<body>
-
-To reproduce this bug outside of DumpRenderTree, click the link below. If broken,
-we will crash. <br>
-
-<script>
-function disappear() {
-    var e = document.getElementById('foo');
-    
-    if(e.style.display !='none') 
-        e.style.display='none'; 
-    else 
-        e.style.display=''; 
-    
-    return false;
-}
-</script>
-
-<table>
-<tr><td><a href="#" onclick="disappear()">link</a></td></tr>
-<tr id="foo" style="">
-    <td>
-    <table>
-        <tr><td>content<br>content<br>content<br></td></tr>
-    </table>
-    </td>
-</tr>
-</table>
-
-<script>
-    if (window.eventSender) {
-        eventSender.mouseMoveTo(30,20);
-        eventSender.mouseDown();
-        eventSender.mouseUp();
-    }
-</script>
-
-</body>
-</html>
diff --git a/tests/tests/webkitsecurity/assets/layoutHorizontalBox-crash.html b/tests/tests/webkitsecurity/assets/layoutHorizontalBox-crash.html
deleted file mode 100755
index d4addfa..0000000
--- a/tests/tests/webkitsecurity/assets/layoutHorizontalBox-crash.html
+++ /dev/null
@@ -1,25 +0,0 @@
-<style>
-.c6:first-letter { visibility: hidden; }
-.c6:nth-last-child(2n+10000000000000000) { text-align: -webkit-center; width: 10px; }
-.c26:first-letter { visibility: inherit; overflow: scroll; float: left;</style>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function runTest() {
-    var button = document.createElement('button');
-    button.setAttribute('class', 'c6');
-    document.documentElement.appendChild(button);
-    document.documentElement.appendChild(document.createElement('dfn'));
-    var figCaption = document.createElement('figcaption');
-    figCaption.setAttribute('class', 'c26');
-    document.documentElement.appendChild(document.createElement('var'));
-    document.documentElement.appendChild(document.createElement('summary'));
-    var text = document.createTextNode("bug 70183: Crash in RenderDeprecatedFlexibleBox::layoutHorizontalBox");
-    figCaption.appendChild(text);
-    button.appendChild(figCaption);
-    document.body.offsetTop;
-    document.documentElement.appendChild(document.createTextNode("If this test did not CRASH or show errors in valgrind, it has PASSED."));
-}
-window.onload = runTest;
-</script>
diff --git a/tests/tests/webkitsecurity/assets/li-style-alpha-huge-value-crash-expected.png b/tests/tests/webkitsecurity/assets/li-style-alpha-huge-value-crash-expected.png
deleted file mode 100644
index e903887..0000000
--- a/tests/tests/webkitsecurity/assets/li-style-alpha-huge-value-crash-expected.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/li-style-alpha-huge-value-crash.html b/tests/tests/webkitsecurity/assets/li-style-alpha-huge-value-crash.html
deleted file mode 100644
index 2c10abd..0000000
--- a/tests/tests/webkitsecurity/assets/li-style-alpha-huge-value-crash.html
+++ /dev/null
@@ -1,7 +0,0 @@
-<blockquote>
-<blockquote>
-<ol>
-<li value=1234567890 type=A>
-<br>
-SUCCESS (you didn't crash)  Our behavior here matches WinIE not FireFox.
-http://bugzilla.opendarwin.org/show_bug.cgi?id=8542
diff --git a/tests/tests/webkitsecurity/assets/line-clamp-crash.html b/tests/tests/webkitsecurity/assets/line-clamp-crash.html
deleted file mode 100644
index 8746f13..0000000
--- a/tests/tests/webkitsecurity/assets/line-clamp-crash.html
+++ /dev/null
@@ -1,38 +0,0 @@
-<p>
-    Test that an incremental layout of a block with line-clamp truncation does not trigger a crash.
-</p>
-<div style="-webkit-box-orient: vertical; -webkit-line-clamp: 5; display: -webkit-box;">
-    <div>
-        <br>
-        <br>
-        <br>
-        <br>
-        <br>
-        <br>
-        <br>
-        <br>
-        <br>
-        <br>
-        <br>
-        <br>
-        <br>
-        <br>
-        <br>
-        <span id="target">Running </span>
-        <a href="#">X</a>
-    </div>
-</div>
-<script>
-    function test()
-    {
-        var placeholder = document.getElementById("target");
-        placeholder.parentNode.removeChild(placeholder);
-    }
-
-    if (window.layoutTestController)
-        layoutTestController.dumpAsText();
-
-    document.body.offsetTop;
-    test();
-    document.body.offsetTop;
-</script>
diff --git a/tests/tests/webkitsecurity/assets/list-item-pseudo-nocrash.html b/tests/tests/webkitsecurity/assets/list-item-pseudo-nocrash.html
deleted file mode 100644
index bb01236..0000000
--- a/tests/tests/webkitsecurity/assets/list-item-pseudo-nocrash.html
+++ /dev/null
@@ -1,52 +0,0 @@
-<!DOCTYPE html>
-<html>
-    <head>
-        <title>List-item + :after pseudo-class</title>
-        <style type="text/css">
-#anchor {
-    display: block;
-}
-#anchor:hover {}
-#anchor:after {
-    content: ".";
-    display: block;
-}
-span {
-    float: left;
-}
-        </style>
-        <script type="application/javascript">
-function run() {
-    if (!window.layoutTestController)
-        return;
-
-    window.layoutTestController.dumpAsText();
-    window.layoutTestController.waitUntilDone();
-    window.eventSender.mouseMoveTo(0, 0);
-    window.setTimeout(hover, 100);
-}
-
-function hover() {
-    var element = document.getElementById('text');
-    var x = element.offsetLeft + element.offsetWidth / 2;
-    var y = element.offsetTop + element.offsetHeight / 2;
-    window.eventSender.mouseMoveTo(x, y);
-    window.setTimeout(finalize, 100);
-}