3 files changed, 32 insertions, 0 deletions
diff --git a/dom/file/tests/crashtests/1480354.html b/dom/file/tests/crashtests/1480354.html
new file mode 100644
index 0000000000..19e53bb1ca
--- /dev/null
+++ b/dom/file/tests/crashtests/1480354.html
@@ -0,0 +1,14 @@
+<html>
+<body>
+  <script>
+function createBlob(blocksize) {
+  var blob = new Blob();
+  while (blob.size < 25 * 1024 * 1024) { // 25 MB
+    blob = new Blob([blob, new Uint8Array(blocksize)]);
+  }
+  URL.createObjectURL(blob);
+}
+createBlob(1024 * 25);
+  </script>
+</body>
+</html>
diff --git a/dom/file/tests/crashtests/1562891.html b/dom/file/tests/crashtests/1562891.html
new file mode 100644
index 0000000000..fff7606a8a
--- /dev/null
+++ b/dom/file/tests/crashtests/1562891.html
@@ -0,0 +1,16 @@
+<html>
+<head>
+  <script>
+    function start () {
+      const canvas = document.createElementNS('http://www.w3.org/1999/xhtml', 'canvas')
+      SpecialPowers.forceGC();
+      canvas.toBlob(function (blob) {
+        blob.stream()
+        blob.arrayBuffer().then(() => {})
+      })
+    }
+
+    window.addEventListener('load', start)
+  </script>
+</head>
+</html>
diff --git a/dom/file/tests/crashtests/crashtests.list b/dom/file/tests/crashtests/crashtests.list
new file mode 100644
index 0000000000..4c2858d223
--- /dev/null
+++ b/dom/file/tests/crashtests/crashtests.list
@@ -0,0 +1,2 @@
+load 1480354.html
+load 1562891.html