From 0ebf5bdf043a27fd3dfb7f92e0cb63d88954c44d Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Fri, 19 Apr 2024 03:47:29 +0200
Subject: Adding upstream version 115.8.0esr.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 dom/media/test/crashtests/0-timescale.html         |  14 ++
 dom/media/test/crashtests/0-timescale.mp4          | Bin 0 -> 14718 bytes
 dom/media/test/crashtests/1012609.html             |   9 +
 dom/media/test/crashtests/1015662.html             |   4 +
 dom/media/test/crashtests/1028458.html             |  23 +++
 dom/media/test/crashtests/1041466.html             |  21 +++
 dom/media/test/crashtests/1045650.html             |  18 ++
 dom/media/test/crashtests/1080986.html             |   3 +
 dom/media/test/crashtests/1080986.wav              | Bin 0 -> 592 bytes
 dom/media/test/crashtests/1122218.html             |  24 +++
 dom/media/test/crashtests/1127188.html             |   3 +
 dom/media/test/crashtests/1157994.html             |  21 +++
 dom/media/test/crashtests/1158427.html             |  21 +++
 dom/media/test/crashtests/1180881.html             |   8 +
 dom/media/test/crashtests/1180881.webm             | Bin 0 -> 524 bytes
 dom/media/test/crashtests/1185176.html             |  24 +++
 dom/media/test/crashtests/1185191.html             |  21 +++
 dom/media/test/crashtests/1185192.html             |  18 ++
 dom/media/test/crashtests/1197935.html             |   8 +
 dom/media/test/crashtests/1197935.mp4              | Bin 0 -> 1806042 bytes
 dom/media/test/crashtests/1223670.html             |  23 +++
 dom/media/test/crashtests/1236639.html             |   9 +
 dom/media/test/crashtests/1236639.mp3              | Bin 0 -> 1080 bytes
 dom/media/test/crashtests/1257700.html             |   8 +
 dom/media/test/crashtests/1257700.webm             | Bin 0 -> 59264 bytes
 dom/media/test/crashtests/1267263.html             |  19 ++
 dom/media/test/crashtests/1270303.html             |   8 +
 dom/media/test/crashtests/1270303.webm             | Bin 0 -> 5822 bytes
 dom/media/test/crashtests/1291702.html             |  72 +++++++
 dom/media/test/crashtests/1368490.html             |  30 +++
 dom/media/test/crashtests/1378826.html             |  46 +++++
 dom/media/test/crashtests/1384248.html             |  10 +
 dom/media/test/crashtests/1388372.html             |  13 ++
 dom/media/test/crashtests/1389304.html             |  32 ++++
 dom/media/test/crashtests/1389304.mp4              | Bin 0 -> 198320 bytes
 dom/media/test/crashtests/1393272.webm             | Bin 0 -> 6781 bytes
 dom/media/test/crashtests/1411322.html             |  18 ++
 dom/media/test/crashtests/1450845.html             |  34 ++++
 dom/media/test/crashtests/1489160.html             |  10 +
 dom/media/test/crashtests/1494073.html             |  19 ++
 dom/media/test/crashtests/1517199.html             |  17 ++
 dom/media/test/crashtests/1526044.html             |  19 ++
 dom/media/test/crashtests/1530897.webm             | Bin 0 -> 509 bytes
 dom/media/test/crashtests/1538727.html             |  14 ++
 dom/media/test/crashtests/1545133.html             |  34 ++++
 dom/media/test/crashtests/1547784.html             |  33 ++++
 dom/media/test/crashtests/1547899.html             |  20 ++
 dom/media/test/crashtests/1560215.html             |  20 ++
 dom/media/test/crashtests/1569645.html             |  23 +++
 dom/media/test/crashtests/1575271.html             |  25 +++
 dom/media/test/crashtests/1577184.html             |  15 ++
 dom/media/test/crashtests/1587248.html             |  23 +++
 dom/media/test/crashtests/1594466.html             |  22 +++
 dom/media/test/crashtests/1601385.html             |  12 ++
 dom/media/test/crashtests/1601422.html             |  20 ++
 dom/media/test/crashtests/1604941.html             |  22 +++
 dom/media/test/crashtests/1608286.html             |  50 +++++
 dom/media/test/crashtests/1673525.html             |  15 ++
 dom/media/test/crashtests/1673526-1.html           |  20 ++
 dom/media/test/crashtests/1673526-2.html           |  20 ++
 dom/media/test/crashtests/1693043.html             |  21 +++
 dom/media/test/crashtests/1696511.html             |  22 +++
 dom/media/test/crashtests/1697521.html             |  19 ++
 dom/media/test/crashtests/1708790.html             |  22 +++
 dom/media/test/crashtests/1709130.html             |  19 ++
 dom/media/test/crashtests/1734008.html             |  22 +++
 dom/media/test/crashtests/1734008.webm             | Bin 0 -> 8253 bytes
 dom/media/test/crashtests/1741677.html             |  15 ++
 dom/media/test/crashtests/1748272.html             |  12 ++
 dom/media/test/crashtests/1752917.html             |  18 ++
 dom/media/test/crashtests/1762620.html             |   8 +
 dom/media/test/crashtests/1765842.html             |   8 +
 dom/media/test/crashtests/1765842.webm             | Bin 0 -> 17210 bytes
 dom/media/test/crashtests/1787281.html             |  13 ++
 dom/media/test/crashtests/1787281.mp4              | Bin 0 -> 2736 bytes
 dom/media/test/crashtests/1798778.html             |  11 ++
 dom/media/test/crashtests/1833894.mp4              | Bin 0 -> 1000465 bytes
 dom/media/test/crashtests/1833896.mp4              | Bin 0 -> 38215 bytes
 dom/media/test/crashtests/1835164.html             |  13 ++
 dom/media/test/crashtests/1835164.opus             | Bin 0 -> 2250 bytes
 dom/media/test/crashtests/1840002.webm             | Bin 0 -> 512 bytes
 dom/media/test/crashtests/1845350.mp4              | Bin 0 -> 1045 bytes
 dom/media/test/crashtests/255ch.wav                | Bin 0 -> 68318 bytes
 dom/media/test/crashtests/459439-1.html            |  36 ++++
 dom/media/test/crashtests/466607-1.html            |  14 ++
 dom/media/test/crashtests/466945-1.html            |  25 +++
 dom/media/test/crashtests/468763-1.html            |   1 +
 dom/media/test/crashtests/474744-1.html            |  15 ++
 dom/media/test/crashtests/481136-1.html            |   3 +
 dom/media/test/crashtests/492286-1.xhtml           |   1 +
 dom/media/test/crashtests/493915-1.html            |  18 ++
 dom/media/test/crashtests/495794-1.html            |   8 +
 dom/media/test/crashtests/495794-1.ogg             | Bin 0 -> 4837 bytes
 dom/media/test/crashtests/497734-1.xhtml           |  21 +++
 dom/media/test/crashtests/497734-2.html            |  17 ++
 dom/media/test/crashtests/576612-1.html            |  15 ++
 dom/media/test/crashtests/691096-1.html            |  31 +++
 dom/media/test/crashtests/752784-1.html            |  15 ++
 dom/media/test/crashtests/789075-1.html            |  20 ++
 dom/media/test/crashtests/789075.webm              | Bin 0 -> 12294 bytes
 dom/media/test/crashtests/795892-1.html            |  23 +++
 dom/media/test/crashtests/844563.html              |   5 +
 dom/media/test/crashtests/846612.html              |   8 +
 dom/media/test/crashtests/852838.html              |  11 ++
 dom/media/test/crashtests/865004.html              |  19 ++
 dom/media/test/crashtests/865537-1.html            |  13 ++
 dom/media/test/crashtests/865550.html              |  22 +++
 dom/media/test/crashtests/868504.html              |  14 ++
 dom/media/test/crashtests/874869.html              |  15 ++
 dom/media/test/crashtests/874915.html              |  24 +++
 dom/media/test/crashtests/874934.html              |  23 +++
 dom/media/test/crashtests/874952.html              |  11 ++
 dom/media/test/crashtests/875144.html              |  81 ++++++++
 dom/media/test/crashtests/875596.html              |  12 ++
 dom/media/test/crashtests/875911.html              |   3 +
 dom/media/test/crashtests/876024-1.html            |   5 +
 dom/media/test/crashtests/876024-2.html            |  17 ++
 dom/media/test/crashtests/876118.html              |  16 ++
 dom/media/test/crashtests/876207.html              |  30 +++
 dom/media/test/crashtests/876215.html              |  14 ++
 dom/media/test/crashtests/876249.html              |  27 +++
 dom/media/test/crashtests/876252.html              |  23 +++
 dom/media/test/crashtests/876834.html              |   4 +
 dom/media/test/crashtests/877527.html              |  37 ++++
 dom/media/test/crashtests/877820.html              |   4 +
 dom/media/test/crashtests/878014.html              |  31 +++
 dom/media/test/crashtests/878328.html              |   5 +
 dom/media/test/crashtests/878407.html              |  11 ++
 dom/media/test/crashtests/878478.html              |  30 +++
 dom/media/test/crashtests/880129.html              |   9 +
 dom/media/test/crashtests/880202.html              |  33 ++++
 dom/media/test/crashtests/880342-1.html            | 208 +++++++++++++++++++++
 dom/media/test/crashtests/880342-2.html            |   8 +
 dom/media/test/crashtests/880384.html              |   8 +
 dom/media/test/crashtests/880404.html              |   6 +
 dom/media/test/crashtests/880724.html              |  13 ++
 dom/media/test/crashtests/881775.html              |  25 +++
 dom/media/test/crashtests/882956.html              |  15 ++
 dom/media/test/crashtests/884459.html              |  12 ++
 dom/media/test/crashtests/889042.html              |   4 +
 dom/media/test/crashtests/907986-1.html            |  17 ++
 dom/media/test/crashtests/907986-2.html            |  17 ++
 dom/media/test/crashtests/907986-3.html            |  17 ++
 dom/media/test/crashtests/907986-4.html            |  15 ++
 dom/media/test/crashtests/910171-1.html            |  17 ++
 dom/media/test/crashtests/920987.html              |   6 +
 dom/media/test/crashtests/925619-1.html            |  14 ++
 dom/media/test/crashtests/925619-2.html            |  15 ++
 dom/media/test/crashtests/926619.html              |  24 +++
 dom/media/test/crashtests/933151.html              |  16 ++
 dom/media/test/crashtests/933156.html              |  23 +++
 dom/media/test/crashtests/944851.html              |  17 ++
 dom/media/test/crashtests/952756.html              |  19 ++
 dom/media/test/crashtests/986901.html              |  16 ++
 dom/media/test/crashtests/990794.html              |  22 +++
 dom/media/test/crashtests/995289.html              |   9 +
 dom/media/test/crashtests/adts-truncated.aac       | Bin 0 -> 512 bytes
 dom/media/test/crashtests/adts.aac                 | Bin 0 -> 8537 bytes
 dom/media/test/crashtests/analyser-channels-1.html |  16 ++
 .../crashtests/audiocontext-after-unload-1.html    |  27 +++
 .../test/crashtests/audiocontext-after-xhr.html    |  13 ++
 .../crashtests/audiocontext-double-suspend.html    |   5 +
 .../audioworkletnode-after-unload-1.html           |  27 +++
 .../test/crashtests/buffer-source-duration-1.html  |  14 ++
 .../test/crashtests/buffer-source-ended-1.html     |  16 ++
 .../buffer-source-resampling-start-1.html          |  16 ++
 .../buffer-source-slow-resampling-1.html           |  34 ++++
 ...count-in-metadata-different-than-in-content.mp4 | Bin 0 -> 13651 bytes
 .../test/crashtests/convolver-memory-report-1.html |  25 +++
 dom/media/test/crashtests/copyFromChannel-2.html   |  16 ++
 dom/media/test/crashtests/cors.webm                | Bin 0 -> 215529 bytes
 dom/media/test/crashtests/cors.webm^headers^       |   1 +
 dom/media/test/crashtests/crashtests.list          | 169 +++++++++++++++++
 .../crashtests/disconnect-wrong-destination.html   |  13 ++
 dom/media/test/crashtests/doppler-1.html           |  23 +++
 dom/media/test/crashtests/empty-buffer-source.html |  14 ++
 dom/media/test/crashtests/empty-samples.webm       |   0
 ...ted-track-with-bad-sample-description-index.mp4 | Bin 0 -> 198320 bytes
 ...ncrypted-track-with-sample-missing-cenc-aux.mp4 | Bin 0 -> 152132 bytes
 .../crashtests/encrypted-track-without-tenc.mp4    | Bin 0 -> 152132 bytes
 .../crashtests/media-element-source-seek-1.html    |  27 +++
 dom/media/test/crashtests/mp4_box_emptyrange.mp4   | Bin 0 -> 918 bytes
 .../crashtests/offline-buffer-source-ended-1.html  |  15 ++
 dom/media/test/crashtests/oscillator-ended-1.html  |  15 ++
 dom/media/test/crashtests/oscillator-ended-2.html  |  15 ++
 dom/media/test/crashtests/sound.ogg                | Bin 0 -> 2603 bytes
 dom/media/test/crashtests/test.mp4                 | Bin 0 -> 11817 bytes
 .../test/crashtests/track-with-zero-dimensions.mp4 | Bin 0 -> 11817 bytes
 dom/media/test/crashtests/video-crash.webm         | Bin 0 -> 58482 bytes
 .../crashtests/video-replay-after-audio-end.html   |  43 +++++
 190 files changed, 3165 insertions(+)
 create mode 100644 dom/media/test/crashtests/0-timescale.html
 create mode 100644 dom/media/test/crashtests/0-timescale.mp4
 create mode 100644 dom/media/test/crashtests/1012609.html
 create mode 100644 dom/media/test/crashtests/1015662.html
 create mode 100644 dom/media/test/crashtests/1028458.html
 create mode 100644 dom/media/test/crashtests/1041466.html
 create mode 100644 dom/media/test/crashtests/1045650.html
 create mode 100644 dom/media/test/crashtests/1080986.html
 create mode 100644 dom/media/test/crashtests/1080986.wav
 create mode 100644 dom/media/test/crashtests/1122218.html
 create mode 100644 dom/media/test/crashtests/1127188.html
 create mode 100644 dom/media/test/crashtests/1157994.html
 create mode 100644 dom/media/test/crashtests/1158427.html
 create mode 100644 dom/media/test/crashtests/1180881.html
 create mode 100644 dom/media/test/crashtests/1180881.webm
 create mode 100644 dom/media/test/crashtests/1185176.html
 create mode 100644 dom/media/test/crashtests/1185191.html
 create mode 100644 dom/media/test/crashtests/1185192.html
 create mode 100644 dom/media/test/crashtests/1197935.html
 create mode 100644 dom/media/test/crashtests/1197935.mp4
 create mode 100644 dom/media/test/crashtests/1223670.html
 create mode 100644 dom/media/test/crashtests/1236639.html
 create mode 100644 dom/media/test/crashtests/1236639.mp3
 create mode 100644 dom/media/test/crashtests/1257700.html
 create mode 100644 dom/media/test/crashtests/1257700.webm
 create mode 100644 dom/media/test/crashtests/1267263.html
 create mode 100644 dom/media/test/crashtests/1270303.html
 create mode 100644 dom/media/test/crashtests/1270303.webm
 create mode 100644 dom/media/test/crashtests/1291702.html
 create mode 100644 dom/media/test/crashtests/1368490.html
 create mode 100644 dom/media/test/crashtests/1378826.html
 create mode 100644 dom/media/test/crashtests/1384248.html
 create mode 100644 dom/media/test/crashtests/1388372.html
 create mode 100644 dom/media/test/crashtests/1389304.html
 create mode 100644 dom/media/test/crashtests/1389304.mp4
 create mode 100644 dom/media/test/crashtests/1393272.webm
 create mode 100644 dom/media/test/crashtests/1411322.html
 create mode 100644 dom/media/test/crashtests/1450845.html
 create mode 100644 dom/media/test/crashtests/1489160.html
 create mode 100644 dom/media/test/crashtests/1494073.html
 create mode 100644 dom/media/test/crashtests/1517199.html
 create mode 100644 dom/media/test/crashtests/1526044.html
 create mode 100644 dom/media/test/crashtests/1530897.webm
 create mode 100644 dom/media/test/crashtests/1538727.html
 create mode 100644 dom/media/test/crashtests/1545133.html
 create mode 100644 dom/media/test/crashtests/1547784.html
 create mode 100644 dom/media/test/crashtests/1547899.html
 create mode 100644 dom/media/test/crashtests/1560215.html
 create mode 100644 dom/media/test/crashtests/1569645.html
 create mode 100644 dom/media/test/crashtests/1575271.html
 create mode 100644 dom/media/test/crashtests/1577184.html
 create mode 100644 dom/media/test/crashtests/1587248.html
 create mode 100644 dom/media/test/crashtests/1594466.html
 create mode 100644 dom/media/test/crashtests/1601385.html
 create mode 100644 dom/media/test/crashtests/1601422.html
 create mode 100644 dom/media/test/crashtests/1604941.html
 create mode 100644 dom/media/test/crashtests/1608286.html
 create mode 100644 dom/media/test/crashtests/1673525.html
 create mode 100644 dom/media/test/crashtests/1673526-1.html
 create mode 100644 dom/media/test/crashtests/1673526-2.html
 create mode 100644 dom/media/test/crashtests/1693043.html
 create mode 100644 dom/media/test/crashtests/1696511.html
 create mode 100644 dom/media/test/crashtests/1697521.html
 create mode 100644 dom/media/test/crashtests/1708790.html
 create mode 100644 dom/media/test/crashtests/1709130.html
 create mode 100644 dom/media/test/crashtests/1734008.html
 create mode 100644 dom/media/test/crashtests/1734008.webm
 create mode 100644 dom/media/test/crashtests/1741677.html
 create mode 100644 dom/media/test/crashtests/1748272.html
 create mode 100644 dom/media/test/crashtests/1752917.html
 create mode 100644 dom/media/test/crashtests/1762620.html
 create mode 100644 dom/media/test/crashtests/1765842.html
 create mode 100644 dom/media/test/crashtests/1765842.webm
 create mode 100644 dom/media/test/crashtests/1787281.html
 create mode 100644 dom/media/test/crashtests/1787281.mp4
 create mode 100644 dom/media/test/crashtests/1798778.html
 create mode 100644 dom/media/test/crashtests/1833894.mp4
 create mode 100644 dom/media/test/crashtests/1833896.mp4
 create mode 100644 dom/media/test/crashtests/1835164.html
 create mode 100644 dom/media/test/crashtests/1835164.opus
 create mode 100644 dom/media/test/crashtests/1840002.webm
 create mode 100644 dom/media/test/crashtests/1845350.mp4
 create mode 100644 dom/media/test/crashtests/255ch.wav
 create mode 100644 dom/media/test/crashtests/459439-1.html
 create mode 100644 dom/media/test/crashtests/466607-1.html
 create mode 100644 dom/media/test/crashtests/466945-1.html
 create mode 100644 dom/media/test/crashtests/468763-1.html
 create mode 100644 dom/media/test/crashtests/474744-1.html
 create mode 100644 dom/media/test/crashtests/481136-1.html
 create mode 100644 dom/media/test/crashtests/492286-1.xhtml
 create mode 100644 dom/media/test/crashtests/493915-1.html
 create mode 100644 dom/media/test/crashtests/495794-1.html
 create mode 100644 dom/media/test/crashtests/495794-1.ogg
 create mode 100644 dom/media/test/crashtests/497734-1.xhtml
 create mode 100644 dom/media/test/crashtests/497734-2.html
 create mode 100644 dom/media/test/crashtests/576612-1.html
 create mode 100644 dom/media/test/crashtests/691096-1.html
 create mode 100644 dom/media/test/crashtests/752784-1.html
 create mode 100644 dom/media/test/crashtests/789075-1.html
 create mode 100644 dom/media/test/crashtests/789075.webm
 create mode 100644 dom/media/test/crashtests/795892-1.html
 create mode 100644 dom/media/test/crashtests/844563.html
 create mode 100644 dom/media/test/crashtests/846612.html
 create mode 100644 dom/media/test/crashtests/852838.html
 create mode 100644 dom/media/test/crashtests/865004.html
 create mode 100644 dom/media/test/crashtests/865537-1.html
 create mode 100644 dom/media/test/crashtests/865550.html
 create mode 100644 dom/media/test/crashtests/868504.html
 create mode 100644 dom/media/test/crashtests/874869.html
 create mode 100644 dom/media/test/crashtests/874915.html
 create mode 100644 dom/media/test/crashtests/874934.html
 create mode 100644 dom/media/test/crashtests/874952.html
 create mode 100644 dom/media/test/crashtests/875144.html
 create mode 100644 dom/media/test/crashtests/875596.html
 create mode 100644 dom/media/test/crashtests/875911.html
 create mode 100644 dom/media/test/crashtests/876024-1.html
 create mode 100644 dom/media/test/crashtests/876024-2.html
 create mode 100644 dom/media/test/crashtests/876118.html
 create mode 100644 dom/media/test/crashtests/876207.html
 create mode 100644 dom/media/test/crashtests/876215.html
 create mode 100644 dom/media/test/crashtests/876249.html
 create mode 100644 dom/media/test/crashtests/876252.html
 create mode 100644 dom/media/test/crashtests/876834.html
 create mode 100644 dom/media/test/crashtests/877527.html
 create mode 100644 dom/media/test/crashtests/877820.html
 create mode 100644 dom/media/test/crashtests/878014.html
 create mode 100644 dom/media/test/crashtests/878328.html
 create mode 100644 dom/media/test/crashtests/878407.html
 create mode 100644 dom/media/test/crashtests/878478.html
 create mode 100644 dom/media/test/crashtests/880129.html
 create mode 100644 dom/media/test/crashtests/880202.html
 create mode 100644 dom/media/test/crashtests/880342-1.html
 create mode 100644 dom/media/test/crashtests/880342-2.html
 create mode 100644 dom/media/test/crashtests/880384.html
 create mode 100644 dom/media/test/crashtests/880404.html
 create mode 100644 dom/media/test/crashtests/880724.html
 create mode 100644 dom/media/test/crashtests/881775.html
 create mode 100644 dom/media/test/crashtests/882956.html
 create mode 100644 dom/media/test/crashtests/884459.html
 create mode 100644 dom/media/test/crashtests/889042.html
 create mode 100644 dom/media/test/crashtests/907986-1.html
 create mode 100644 dom/media/test/crashtests/907986-2.html
 create mode 100644 dom/media/test/crashtests/907986-3.html
 create mode 100644 dom/media/test/crashtests/907986-4.html
 create mode 100644 dom/media/test/crashtests/910171-1.html
 create mode 100644 dom/media/test/crashtests/920987.html
 create mode 100644 dom/media/test/crashtests/925619-1.html
 create mode 100644 dom/media/test/crashtests/925619-2.html
 create mode 100644 dom/media/test/crashtests/926619.html
 create mode 100644 dom/media/test/crashtests/933151.html
 create mode 100644 dom/media/test/crashtests/933156.html
 create mode 100644 dom/media/test/crashtests/944851.html
 create mode 100644 dom/media/test/crashtests/952756.html
 create mode 100644 dom/media/test/crashtests/986901.html
 create mode 100644 dom/media/test/crashtests/990794.html
 create mode 100644 dom/media/test/crashtests/995289.html
 create mode 100644 dom/media/test/crashtests/adts-truncated.aac
 create mode 100644 dom/media/test/crashtests/adts.aac
 create mode 100644 dom/media/test/crashtests/analyser-channels-1.html
 create mode 100644 dom/media/test/crashtests/audiocontext-after-unload-1.html
 create mode 100644 dom/media/test/crashtests/audiocontext-after-xhr.html
 create mode 100644 dom/media/test/crashtests/audiocontext-double-suspend.html
 create mode 100644 dom/media/test/crashtests/audioworkletnode-after-unload-1.html
 create mode 100644 dom/media/test/crashtests/buffer-source-duration-1.html
 create mode 100644 dom/media/test/crashtests/buffer-source-ended-1.html
 create mode 100644 dom/media/test/crashtests/buffer-source-resampling-start-1.html
 create mode 100644 dom/media/test/crashtests/buffer-source-slow-resampling-1.html
 create mode 100644 dom/media/test/crashtests/channel-count-in-metadata-different-than-in-content.mp4
 create mode 100644 dom/media/test/crashtests/convolver-memory-report-1.html
 create mode 100644 dom/media/test/crashtests/copyFromChannel-2.html
 create mode 100644 dom/media/test/crashtests/cors.webm
 create mode 100644 dom/media/test/crashtests/cors.webm^headers^
 create mode 100644 dom/media/test/crashtests/crashtests.list
 create mode 100644 dom/media/test/crashtests/disconnect-wrong-destination.html
 create mode 100644 dom/media/test/crashtests/doppler-1.html
 create mode 100644 dom/media/test/crashtests/empty-buffer-source.html
 create mode 100644 dom/media/test/crashtests/empty-samples.webm
 create mode 100644 dom/media/test/crashtests/encrypted-track-with-bad-sample-description-index.mp4
 create mode 100644 dom/media/test/crashtests/encrypted-track-with-sample-missing-cenc-aux.mp4
 create mode 100644 dom/media/test/crashtests/encrypted-track-without-tenc.mp4
 create mode 100644 dom/media/test/crashtests/media-element-source-seek-1.html
 create mode 100644 dom/media/test/crashtests/mp4_box_emptyrange.mp4
 create mode 100644 dom/media/test/crashtests/offline-buffer-source-ended-1.html
 create mode 100644 dom/media/test/crashtests/oscillator-ended-1.html
 create mode 100644 dom/media/test/crashtests/oscillator-ended-2.html
 create mode 100644 dom/media/test/crashtests/sound.ogg
 create mode 100644 dom/media/test/crashtests/test.mp4
 create mode 100644 dom/media/test/crashtests/track-with-zero-dimensions.mp4
 create mode 100644 dom/media/test/crashtests/video-crash.webm
 create mode 100644 dom/media/test/crashtests/video-replay-after-audio-end.html

(limited to 'dom/media/test/crashtests')

diff --git a/dom/media/test/crashtests/0-timescale.html b/dom/media/test/crashtests/0-timescale.html
new file mode 100644
index 0000000000..db845096dd
--- /dev/null
+++ b/dom/media/test/crashtests/0-timescale.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+</head>
+<body>
+<!-- This video file has a timescale of 0 in the mdhd atom -->
+<video src="0-timescale.mp4"
+       autoplay
+       onerror="document.documentElement.className=undefined"
+       onloadedmetadata="this.src=''; document.documentElement.className=undefined">
+<!-- Note we reset 'src' to release decoder resources and cubeb streams to prevent OOM or OpenCubeb() failures. -->
+</video>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/0-timescale.mp4 b/dom/media/test/crashtests/0-timescale.mp4
new file mode 100644
index 0000000000..32df5dc5a5
Binary files /dev/null and b/dom/media/test/crashtests/0-timescale.mp4 differ
diff --git a/dom/media/test/crashtests/1012609.html b/dom/media/test/crashtests/1012609.html
new file mode 100644
index 0000000000..1dad783a07
--- /dev/null
+++ b/dom/media/test/crashtests/1012609.html
@@ -0,0 +1,9 @@
+<script>
+try{var r0=new AudioContext();}catch(e){}
+try{var r32=r0.createOscillator();}catch(e){}
+try{var r58=r0.createPeriodicWave(new Float32Array(1997),new Float32Array(1997));}catch(e){}
+try{r32.start(0);}catch(e){}
+try{r32.setPeriodicWave(r58);}catch(e){}
+try{r32.frequency.value=-1;}catch(e){}
+</script>
+
diff --git a/dom/media/test/crashtests/1015662.html b/dom/media/test/crashtests/1015662.html
new file mode 100644
index 0000000000..20407c807d
--- /dev/null
+++ b/dom/media/test/crashtests/1015662.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<body>
+<video><track src="javascript:5"></track></video>
+</body>
diff --git a/dom/media/test/crashtests/1028458.html b/dom/media/test/crashtests/1028458.html
new file mode 100644
index 0000000000..bb01e3343a
--- /dev/null
+++ b/dom/media/test/crashtests/1028458.html
@@ -0,0 +1,23 @@
+<html class="reftest-wait">
+<audio id="testAudio" controls></audio>
+<script type="text/javascript">
+navigator.mozGetUserMedia({audio: true, fake: true}, function(stream) {
+    stream.getAudioTracks()[0].enabled = false;
+    var testAudio = document.getElementById('testAudio');
+    // Wait some time for good measure
+    var eventReceived = 0;
+    testAudio.addEventListener("timeupdate", function() {
+      if (++eventReceived == 3) {
+        document.querySelector("html").className = "";
+      }
+    })
+    testAudio.srcObject = stream;
+    testAudio.play();
+    }, function(err) {
+      // Don't go orange if we can't get an audio input stream,
+      // as this is not what we are trying to test and can happen on Windows.
+      document.querySelector("html").className = "";
+    });
+</script>
+
+</html>
diff --git a/dom/media/test/crashtests/1041466.html b/dom/media/test/crashtests/1041466.html
new file mode 100644
index 0000000000..0f064d186c
--- /dev/null
+++ b/dom/media/test/crashtests/1041466.html
@@ -0,0 +1,21 @@
+<html>
+<script>
+try{var Context1= new (window.webkitAudioContext || window.AudioContext)()}catch(e){}
+try{var Delay0=Context1.createDelay();}catch(e){}
+try{var ScriptProcessor0=Context1.createScriptProcessor(512,26,7);}catch(e){}
+try{var ChannelSplitter0=Context1.createChannelSplitter(91);}catch(e){}
+try{var Gain1=Context1.createGain();}catch(e){}
+try{var WaveShaper0=Context1.createWaveShaper();}catch(e){}
+try{var Analyser1=Context1.createAnalyser();}catch(e){}
+try{Gain1.connect(Delay0);}catch(e){}
+try{Analyser1.connect(BiquadFilter0);}catch(e){}
+try{Gain1.connect(Context1.destination);}catch(e){}
+try{WaveShaper0.connect(ScriptProcessor0);}catch(e){}
+try{ChannelSplitter0.connect(BiquadFilter1);}catch(e){}
+try{Delay0.connect(Gain1);}catch(e){}
+try{ScriptProcessor0.connect(Context1.destination);}catch(e){}
+try{WaveShaper0.connect(Gain1);}catch(e){}
+try{WaveShaper0.connect(ChannelSplitter0);}catch(e){}
+try{ScriptProcessor0.connect(WaveShaper0);}catch(e){}
+</script>
+</html>
diff --git a/dom/media/test/crashtests/1045650.html b/dom/media/test/crashtests/1045650.html
new file mode 100644
index 0000000000..32acd2ce75
--- /dev/null
+++ b/dom/media/test/crashtests/1045650.html
@@ -0,0 +1,18 @@
+<html><body><script>
+
+var r0=new AudioContext();
+
+var splitter=r0.createChannelSplitter();
+var delay=r0.createDelay();
+var scriptp=r0.createScriptProcessor();
+var cmerger=r0.createChannelMerger();
+var gain=r0.createGain();
+
+splitter.connect(delay,2);
+delay.connect(scriptp);
+scriptp.connect(cmerger);
+cmerger.connect(splitter);
+gain.connect(gain);
+gain.connect(cmerger);
+
+</script></body></html>
diff --git a/dom/media/test/crashtests/1080986.html b/dom/media/test/crashtests/1080986.html
new file mode 100644
index 0000000000..1de3075169
--- /dev/null
+++ b/dom/media/test/crashtests/1080986.html
@@ -0,0 +1,3 @@
+<html>
+<audio autoplay src="1080986.wav"></audio>
+</html>
diff --git a/dom/media/test/crashtests/1080986.wav b/dom/media/test/crashtests/1080986.wav
new file mode 100644
index 0000000000..b96c59b7ec
Binary files /dev/null and b/dom/media/test/crashtests/1080986.wav differ
diff --git a/dom/media/test/crashtests/1122218.html b/dom/media/test/crashtests/1122218.html
new file mode 100644
index 0000000000..984487dd21
--- /dev/null
+++ b/dom/media/test/crashtests/1122218.html
@@ -0,0 +1,24 @@
+<html>
+<head>
+<script>
+function boom() {
+  var r0=new AudioContext();
+
+  var cm=r0.createChannelMerger(20);
+
+  var o1=r0.createOscillator();
+  var o2=r0.createOscillator();
+
+  var pw=r0.createPeriodicWave(new Float32Array(4),new Float32Array(4));
+  o2.setPeriodicWave(pw);
+
+  o1.connect(cm);
+  cm.connect(o2.frequency);
+
+  o1.start();
+  o2.start(0.476);
+}
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/media/test/crashtests/1127188.html b/dom/media/test/crashtests/1127188.html
new file mode 100644
index 0000000000..650f07dd47
--- /dev/null
+++ b/dom/media/test/crashtests/1127188.html
@@ -0,0 +1,3 @@
+<script>
+  (new AudioContext).close();
+</script>
diff --git a/dom/media/test/crashtests/1157994.html b/dom/media/test/crashtests/1157994.html
new file mode 100644
index 0000000000..2e3001302a
--- /dev/null
+++ b/dom/media/test/crashtests/1157994.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+    var ac = new AudioContext();
+    // first "suspended" -> "running" transition
+    ac.onstatechange = function() {
+      ac.onstatechange = null;
+      ac.suspend();
+      ac.close();
+    }
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
+
diff --git a/dom/media/test/crashtests/1158427.html b/dom/media/test/crashtests/1158427.html
new file mode 100644
index 0000000000..b544a942a1
--- /dev/null
+++ b/dom/media/test/crashtests/1158427.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  dump("before capture\n");
+  document.createElement("audio").mozCaptureStreamUntilEnded();
+  dump("before context\n");
+  new window.AudioContext();
+  dump("before gc\n");
+  SpecialPowers.forceCC();
+  dump("after gc\n");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
+
diff --git a/dom/media/test/crashtests/1180881.html b/dom/media/test/crashtests/1180881.html
new file mode 100644
index 0000000000..d5bf2f5642
--- /dev/null
+++ b/dom/media/test/crashtests/1180881.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+<video src="1180881.webm" autoplay></video>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1180881.webm b/dom/media/test/crashtests/1180881.webm
new file mode 100644
index 0000000000..2fb2be7a7f
Binary files /dev/null and b/dom/media/test/crashtests/1180881.webm differ
diff --git a/dom/media/test/crashtests/1185176.html b/dom/media/test/crashtests/1185176.html
new file mode 100644
index 0000000000..d5e9b68a29
--- /dev/null
+++ b/dom/media/test/crashtests/1185176.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+    var ac = new window.AudioContext();
+    var oscillator = ac.createOscillator();
+    oscillator.start(0);
+    oscillator.stop(0.1);
+    setTimeout(function() {
+      oscillator.channelCount = 1;
+      oscillator.channelCountMode = "explicit";
+      oscillator.channelInterpretation = "speakers";
+      document.documentElement.removeAttribute("class");
+    }, 1000);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
+
diff --git a/dom/media/test/crashtests/1185191.html b/dom/media/test/crashtests/1185191.html
new file mode 100644
index 0000000000..4ed5ba2ee2
--- /dev/null
+++ b/dom/media/test/crashtests/1185191.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+    var a = new AudioContext();
+    var b = new BroadcastChannel("x");
+    a.addEventListener("statechange", bye, false);
+}
+
+function bye()
+{
+    document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/media/test/crashtests/1185192.html b/dom/media/test/crashtests/1185192.html
new file mode 100644
index 0000000000..46fa311aa2
--- /dev/null
+++ b/dom/media/test/crashtests/1185192.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+    new Audio().mozCaptureStreamUntilEnded();
+    var ac = new window.AudioContext();
+    ac.resume();
+    ac.close();
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
+
diff --git a/dom/media/test/crashtests/1197935.html b/dom/media/test/crashtests/1197935.html
new file mode 100644
index 0000000000..dd8ad0382d
--- /dev/null
+++ b/dom/media/test/crashtests/1197935.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+<video src="1197935.mp4" autoplay></video>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1197935.mp4 b/dom/media/test/crashtests/1197935.mp4
new file mode 100644
index 0000000000..f00de75627
Binary files /dev/null and b/dom/media/test/crashtests/1197935.mp4 differ
diff --git a/dom/media/test/crashtests/1223670.html b/dom/media/test/crashtests/1223670.html
new file mode 100644
index 0000000000..94cad43e23
--- /dev/null
+++ b/dom/media/test/crashtests/1223670.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+
+    var ac = new window.AudioContext("publicnotification");
+
+    setTimeout(function() {
+        document.documentElement.removeAttribute("class");
+        var htmlAudio = new Audio();
+        var stream = htmlAudio.mozCaptureStreamUntilEnded();
+        ac.createMediaStreamSource(stream);
+    }, 0);
+}
+
+</script>
+</head>
+<body onload="boom();">
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1236639.html b/dom/media/test/crashtests/1236639.html
new file mode 100644
index 0000000000..5c4634a4d4
--- /dev/null
+++ b/dom/media/test/crashtests/1236639.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Bug 1236639: Crash on audio playback due to invalid XING headers</title>
+</head>
+<body>
+<audio autoplay src="1236639.mp3"></audio>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1236639.mp3 b/dom/media/test/crashtests/1236639.mp3
new file mode 100644
index 0000000000..8ef96e8cc7
Binary files /dev/null and b/dom/media/test/crashtests/1236639.mp3 differ
diff --git a/dom/media/test/crashtests/1257700.html b/dom/media/test/crashtests/1257700.html
new file mode 100644
index 0000000000..5377b17da5
--- /dev/null
+++ b/dom/media/test/crashtests/1257700.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+<video src="1257700.webm" autoplay></video>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1257700.webm b/dom/media/test/crashtests/1257700.webm
new file mode 100644
index 0000000000..63e53c8c0a
Binary files /dev/null and b/dom/media/test/crashtests/1257700.webm differ
diff --git a/dom/media/test/crashtests/1267263.html b/dom/media/test/crashtests/1267263.html
new file mode 100644
index 0000000000..a4d0e621cd
--- /dev/null
+++ b/dom/media/test/crashtests/1267263.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+    vid.setMediaKeys(null);
+    vid.fastSeek(111);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+  <video id="vid" src="../../../../layout/reftests/webm-video/frames.webm"></video>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1270303.html b/dom/media/test/crashtests/1270303.html
new file mode 100644
index 0000000000..23608bb2b8
--- /dev/null
+++ b/dom/media/test/crashtests/1270303.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+<video src="1270303.webm" autoplay></video>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1270303.webm b/dom/media/test/crashtests/1270303.webm
new file mode 100644
index 0000000000..c9b0003d6b
Binary files /dev/null and b/dom/media/test/crashtests/1270303.webm differ
diff --git a/dom/media/test/crashtests/1291702.html b/dom/media/test/crashtests/1291702.html
new file mode 100644
index 0000000000..54f17b45b8
--- /dev/null
+++ b/dom/media/test/crashtests/1291702.html
@@ -0,0 +1,72 @@
+<script>
+Logger={}; Logger.JSError=function(e){};
+try { o0 = new Audio("media/audio/mono-uncompressed-8bit-44100hz.wav") } catch(e) { Logger.JSError(e); }
+try { o1 = o0.mozCaptureStreamUntilEnded() } catch(e) { Logger.JSError(e); }
+try { o2 = new window.AudioContext(); } catch(e) { Logger.JSError(e); }
+try { o3 = o2.createBufferSource(); } catch(e) { Logger.JSError(e); }
+try { o5 = o2.createChannelMerger(3); } catch(e) { Logger.JSError(e); }
+try { o3.start(0) } catch(e) { Logger.JSError(e); }
+try { o2.listener.setPosition(0.0417049336344248, 0.9932504594310304, 32) } catch(e) { Logger.JSError(e); }
+try { o5.disconnect(0) } catch(e) { Logger.JSError(e); }
+try { o0.mozGetMetadata() } catch(e) { Logger.JSError(e); }
+try { o3.channelCount = 1; } catch(e) { Logger.JSError(e); }
+try { o3.buffer = function anonymous() {
+var buffer = o2.createBuffer(1, 512, o2.sampleRate);for(var c=0;c<1;c++) {var data = buffer.getChannelData(c);for(var i=0;i<512;i++) {data[i] = i % 512}}return buffer;
+}(); } catch(e) { Logger.JSError(e); }
+try { o3.loop = false; } catch(e) { Logger.JSError(e); }
+try { o0.preservesPitch = false; } catch(e) { Logger.JSError(e); }
+try { o2.destination.channelCount = 1; } catch(e) { Logger.JSError(e); }
+try { o3.loopStart = 8; } catch(e) { Logger.JSError(e); }
+try { o3.playbackRate.value = 0.46271130895770884; } catch(e) { Logger.JSError(e); }
+try { o2.listener.setVelocity(0.34781960219792546, 4, 2048) } catch(e) { Logger.JSError(e); }
+try { o5.connect(o5, 0, 0) } catch(e) { Logger.JSError(e); }
+try { o3.loopStart = -0.24696638021780326; } catch(e) { Logger.JSError(e); }
+try { o0.mozSetup(1, 44100) } catch(e) { Logger.JSError(e); }
+try { o3.buffer.copyToChannel(function anonymous() {
+var buffer=new Float32Array(256);for(var i=0;i<256;i++){buffer[i]=i / 256}return buffer;
+}(), 1, 2048, 64) } catch(e) { Logger.JSError(e); }
+try { o3.loop = false; } catch(e) { Logger.JSError(e); }
+try { setInterval(function anonymous() {
+try { o0.pause() } catch(e) { Logger.JSError(e); }
+}, 12.902067779658143) } catch(e) { Logger.JSError(e); }
+try { o2.listener.setPosition(256, 256, 16) } catch(e) { Logger.JSError(e); }
+try { o3.playbackRate.setValueCurveAtTime(function anonymous() {
+var buffer=new Float32Array(4);for(var i=0;i<4;i++){buffer[i]=i / 4}return buffer;
+}(), 2, 0.40792575814014437) } catch(e) { Logger.JSError(e); }
+try { o3.playbackRate.value = 0.4997270553139334; } catch(e) { Logger.JSError(e); }
+try { o0.loop = true; } catch(e) { Logger.JSError(e); }
+try { o3.loopStart = 4; } catch(e) { Logger.JSError(e); }
+try { setInterval(function anonymous() {
+try { o3.buffer = function anonymous() {
+var buffer = o2.createBuffer(1, 1, o2.sampleRate);for(var c=0;c<1;c++) {var data = buffer.getChannelData(c);for(var i=0;i<1;i++) {data[i] = Math.sin(Math.sin(i))}}return buffer;
+}() } catch(e) { Logger.JSError(e); }
+}, 54.32078602859342) } catch(e) { Logger.JSError(e); }
+try { o3.connect(o2.destination); } catch(e) { Logger.JSError(e); }
+try { o3.channelCountMode = 'max'; } catch(e) { Logger.JSError(e); }
+try { setInterval(function anonymous() {
+try { o3.channelCount = 1; } catch(e) { Logger.JSError(e); }
+}, 55.448587039802966) } catch(e) { Logger.JSError(e); }
+try { o3.playbackRate.cancelScheduledValues(0.7190983131805198) } catch(e) { Logger.JSError(e); }
+try { o3.playbackRate.cancelScheduledValues(16) } catch(e) { Logger.JSError(e); }
+try { o3.connect(o5, 0, 2) } catch(e) { Logger.JSError(e); }
+try { o3.loopEnd = 0.5864771678080962; } catch(e) { Logger.JSError(e); }
+try { o0.playbackRate = 0.2781783298771312; } catch(e) { Logger.JSError(e); }
+try { o0.loop = false; } catch(e) { Logger.JSError(e); }
+try { setInterval(function anonymous() {
+try { o5.disconnect(0) } catch(e) { Logger.JSError(e); }
+}, 29.75776777646425) } catch(e) { Logger.JSError(e); }
+try { o3.playbackRate.setValueCurveAtTime(function anonymous() {
+var buffer=new Float32Array(8);for(var i=0;i<8;i++){buffer[i]=8 % 8}return buffer;
+}(), 0.4972710112336257, 64) } catch(e) { Logger.JSError(e); }
+try { setInterval(function anonymous() {
+try { o0.controls = false; } catch(e) { Logger.JSError(e); }
+}, 22.550249570567694) } catch(e) { Logger.JSError(e); }
+try { o2.listener.setOrientation(0.6531494410366634, 64, 0.5120918081402992, -64, 0.32912433155093446, 256) } catch(e) { Logger.JSError(e); }
+try { o3.loop = true; } catch(e) { Logger.JSError(e); }
+try { o3.connect(o5, 0, 0) } catch(e) { Logger.JSError(e); }
+try { o3.buffer = function anonymous() {
+var buffer = o2.createBuffer(1, 2048, 48000);for(var c=0;c<1;c++) {var data = buffer.getChannelData(c);for(var i=0;i<2048;i++) {data[i] = Math.sin(Math.sin(2048 * 0.2519529190035427))}}return buffer;
+}(); } catch(e) { Logger.JSError(e); }
+try { o3.disconnect(0) } catch(e) { Logger.JSError(e); }
+</script>
+
diff --git a/dom/media/test/crashtests/1368490.html b/dom/media/test/crashtests/1368490.html
new file mode 100644
index 0000000000..8a2d9f9674
--- /dev/null
+++ b/dom/media/test/crashtests/1368490.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+  <title> Bug 1368490 : Crash if media recorder source stream reduces number of channels. </title>
+</head>
+<meta charset="utf-8">
+<script type="text/javascript">
+
+function boom() {
+  let audioContext = new window.AudioContext();
+  let oscillator  = audioContext.createOscillator();
+  let dst = audioContext.createMediaStreamDestination();
+  oscillator.channelCount = 4;
+  dst.channelCount = 4;
+  oscillator.connect(dst, 0, 0);
+  oscillator.start();
+  mediaRec = new MediaRecorder(dst.stream);
+
+  mediaRec.start(100);
+  setTimeout(() => {
+    dst.channelCount = 1;
+    setTimeout(() => {
+      mediaRec.stop();
+      document.documentElement.removeAttribute("class");
+    }, 100);
+  }, 100);
+}
+</script>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/media/test/crashtests/1378826.html b/dom/media/test/crashtests/1378826.html
new file mode 100644
index 0000000000..e1913cd0f5
--- /dev/null
+++ b/dom/media/test/crashtests/1378826.html
@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<title>Bug 1378826 : Removing last video track from recorder stream crashes.</title>
+</head>
+<body>
+<canvas id="canvas"></canvas>
+<script type="text/javascript">
+
+function wait(ms) {
+  return new Promise(resolve => setTimeout(resolve, ms));
+}
+
+function boom() {
+  let canvas = document.getElementById("canvas");
+  let ctx = canvas.getContext('2d');
+  ctx.fillRect(10, 10, 100, 100);
+  let stream = canvas.captureStream();
+  let rec = new MediaRecorder(stream);
+  // At the time of fixing this bug onstop would fire, but this may change in
+  // future. As such defensively listen for onerror too to prevent this test
+  // timing out.
+  let stoppedPromise = new Promise(y => (rec.onstop = y,
+                                         rec.onerror = e => y));
+  rec.onstart = () => {
+    // Remove the video track from the stream we're recording
+    stream.removeTrack(stream.getTracks()[0]);
+    // Recorder should stop or error in response to the above
+    return stoppedPromise
+    .then(() => {
+      // Little wait to help get bad writes if they're going to happen
+      wait(100)
+      .then(() => {
+        // Didn't crash, finish
+        document.documentElement.removeAttribute("class");
+      });
+    });
+  };
+  rec.start();
+}
+
+window.onload = boom;
+
+</script>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1384248.html b/dom/media/test/crashtests/1384248.html
new file mode 100644
index 0000000000..5d9c60edda
--- /dev/null
+++ b/dom/media/test/crashtests/1384248.html
@@ -0,0 +1,10 @@
+<html>
+  <head>
+    <script>
+      try { o1 = document.createElement('audio') } catch(e) { }
+      try { o2 = document.implementation.createDocument('', '', null).adoptNode(o1); } catch(e) { };
+      try { o3 = new AudioContext('alarm') } catch(e) { }
+      try { o3.createMediaElementSource(o1) } catch(e) { }
+    </script>
+  </head>
+</html>
diff --git a/dom/media/test/crashtests/1388372.html b/dom/media/test/crashtests/1388372.html
new file mode 100644
index 0000000000..977ebddf53
--- /dev/null
+++ b/dom/media/test/crashtests/1388372.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+navigator.mediaDevices.getUserMedia({audio: {
+    echoCancellation: false,
+    noiseSuppression: false,
+    autoGainControl: false
+  }, fake: true
+}).then((stream) => {
+    document.documentElement.removeAttribute("class");
+})
+</script>
+</html>
diff --git a/dom/media/test/crashtests/1389304.html b/dom/media/test/crashtests/1389304.html
new file mode 100644
index 0000000000..df419c51d7
--- /dev/null
+++ b/dom/media/test/crashtests/1389304.html
@@ -0,0 +1,32 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Media test: Negative duration.</title>
+</head>
+<body>
+
+<video id="v" controls src="1389304.mp4">
+</video>
+<p id="msg"></p>
+
+<script type="text/javascript">
+
+function log(x) {
+  msg.innerHTML = x + "<br>";
+}
+
+v.play();
+v.onended = function() {
+	log("endded!");
+	let seekable = v.seekable;
+	for (let i = 0; i < seekable.length; ++i) {
+		let start = seekable.start(i);
+		let end = seekable.end(i);
+		log(`[${i}]: start=${start} end=${end}`);
+	}
+}
+
+</script>
+
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1389304.mp4 b/dom/media/test/crashtests/1389304.mp4
new file mode 100644
index 0000000000..25cd746972
Binary files /dev/null and b/dom/media/test/crashtests/1389304.mp4 differ
diff --git a/dom/media/test/crashtests/1393272.webm b/dom/media/test/crashtests/1393272.webm
new file mode 100644
index 0000000000..1f1cade6dc
Binary files /dev/null and b/dom/media/test/crashtests/1393272.webm differ
diff --git a/dom/media/test/crashtests/1411322.html b/dom/media/test/crashtests/1411322.html
new file mode 100644
index 0000000000..772b68f0cc
--- /dev/null
+++ b/dom/media/test/crashtests/1411322.html
@@ -0,0 +1,18 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Bug 1411322: Shutdown after getting memory reports from MediaRecorder</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<audio id="audio"></audio>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+let recorder = new MediaRecorder(audio.mozCaptureStream());
+recorder.start();
+SpecialPowers.getMemoryReports();
+</script>
+</pre>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1450845.html b/dom/media/test/crashtests/1450845.html
new file mode 100644
index 0000000000..451d116e83
--- /dev/null
+++ b/dom/media/test/crashtests/1450845.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+  <title>Bug 1450845: Avoid seek to next frame when already seeking</title>
+  <script>
+    async function boom() {
+      let video = document.getElementById('video');
+
+      // Internally play causes a seek, make sure we don't crash during this
+      video.play();
+      try {
+        await document.getElementById('video').seekToNextFrame();
+      } catch (e) {
+        // We don't mind if the promise was rejected so long as we don't crash
+      }
+      // Didn't crash
+
+      // Stop playback and cause a seek to 0
+      video.pause();
+      video.currentTime = 0;
+      try {
+        await document.getElementById('video').seekToNextFrame();
+      } finally {
+        // Didn't crash
+        document.documentElement.removeAttribute("class");
+      }
+    }
+    window.addEventListener('load', boom)
+  </script>
+</head>
+<body>
+  <video id='video' src='data:video/webm;base64,GkXfowEAAAAAAAAfQoaBAUL3gQFC8oEEQvOBQoWBAhhTgGcBAAAAAAAB6BFNm3RALE27i1OrhBVJqWZTrIHfTbuMU6uEFlSua1OsggEwTbuMU6uEHFO7a1OsggHL7AEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVSalmAQAAAAAAAEUqTYCNTGF2ZjU3LjI5LjEwMVdBjUxhdmY1Ny4yOS4xMDFzpJBAb17Yv2oNAF1ZEESuco33RImIQFCAAAAAAAAWVK5rAQAAAAAAADyuAQAAAAAAADPXgQFzxYEBnIEAIrWcg3VuZIaFVl9WUDmDgQEj44OEAfygVeABAAAAAAAAB7CCAUC6gfAfQ7Z1AQAAAAAAAEfngQCjqYEAAICCSYNCABPwDvYAOCQcGFQAAFBh9jAAABML7AAATEnjdRwIJ+gAo5eBACEAhgBAkpwATEAABCasAABekcXgAB'>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1489160.html b/dom/media/test/crashtests/1489160.html
new file mode 100644
index 0000000000..c4f643700c
--- /dev/null
+++ b/dom/media/test/crashtests/1489160.html
@@ -0,0 +1,10 @@
+<html>
+<head>
+<script>
+audio = new AudioContext()
+audio.close()
+audio.close()
+</script>
+</head>
+</html>
+
diff --git a/dom/media/test/crashtests/1494073.html b/dom/media/test/crashtests/1494073.html
new file mode 100644
index 0000000000..41e7a36554
--- /dev/null
+++ b/dom/media/test/crashtests/1494073.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+  <title>Bug 1494073: Setting playback rate too high</title>
+  <script>
+    function finish() {
+      document.documentElement.removeAttribute("class");
+    }
+    var src="data:audio/wav;base64,UklGRqsTAABXQVZFZm10IBAAAAABAAMA8FUAANABAQADAAgAZGF0YYcTAAAUCnYAPm6YALYJSgA4IO8A9UuWALiiZQAYWc4AnMNoAKcc9gBmWLcAtL0NAAGU0QDbSgMA777tAEkfrQD14E4A2nb/AERxxAD5c+0AmplbADUo0AC14DQAXWgRAGsl4wB0oGIAkVlkAOWmTwCm/fEAZqErAEHpqgAMXjkA5AlGAMsOOwAUQAsABvRfAJyVUwDTKM8AtIMYAKh6lQDPkq0A9JtqAKiudAD2I3wAHTsPAOy36ACLtz8ATQELAJCXQgDpxksA4BzzABSR7gD7vMEAgo/6AKovngCZNLoA0A5UALhiFABNVRQAjXIuABmhFACj8/sAt+bQAP71dgCbdGoAXuf5AN5zVAACgggAlHiqAGTPswC0x5oAsgxDAEimygCYlMUAS3r2AKFS0gCZzCYAnXPZAEU8cgAf2gQADqF2ACCY+ABSVIEAW17CANxZWQCk0s0AIF1kALYn7gC9U3MAQqRFAHSUegC1UR8Au99GADrbaQCQQksAOQ6kALUmMgAC0YQAS9rjAMNL9QAQKkcAayg7AOjHXgBNZxcAzIUrAAgq+ACVJPMAV5s2APTVsgAsxX4AMP9cAInlqADcltMAv10FAAzJAgDiHQ4AbsW4ACDTowC897AAx1A8AGw3JwBe6msAf/jJAL1PbwCYYRkAscdyACi8+QCXCEwABWnAAOz4QQC0W60AcToLAH4/+wBion0AzzBXAJCuHgAsv+gAvDmdAA1LaAC04xgA/KU6AAurkwCbpwkAzkTeAA9+SABQqJoAPFHNAK96FgDxMNkAaPelAOG5YgCJsS8AtUp8ALhn8gD7sIYAxoR+AMWFHgA3aRIA00/wABwXJwCmQVQAxU7xAGnkjABvBaUAMz8UAL7qjQBokUEAx8eOAAd/ogDKKqcAsx8EAEpW/AADoDAA/D1+AKVqMwDnkmYA/fOAAGpcfwAlm3UA5+t8AM5tMwCdW3cA2UzjABHxWQBKIx4A7bf3AC+RkgARtBAA27gWADcb/ADjO68AS+g0AMutgwAzRawAtbgLAGjfnwCGINIAowqrAFsDmACIyhgAHfz+AByCiABBwdYASnWAANadowA7KFYADTx1ALG1WAAm4csAti5iACQMZgAeg7MAtrnPAMRmsAAsONAAKR6XAEu5TQCrqMYAd0hcABAU8gCLBFEA2C0MAJ7nZwAETAYA6i53APxR2gDRwBsAf392AH/csgAidosA3MaAAKgCrQBwid4A4xUfAHpqnACYWcQAHfIoAO67cQBlKVUAfR6pAEvQyQDFcWoA82ivAGsVXAA5gcQA8YCIAH9igAC6EzIAvrJEACTfdgBM21wAE6W+ABkqTwAL0+wA85kAALdRfQDbetYAT9RxALUxoQDScSoACRY8AIOzSwAUQS4A6yG1ALDLIwCf5vUAUvQTAK8r+QC5zVoAckBEABQfYwBFzoQAEUyXANlojQBGhjMA0WNjAI0qOQC7TIkAMbboAAp5igBw640ArVL3ADsU7QBoR/cAemWCAChwZQDuILoApIhRAOXapADr/IAApX7IAKvnxABvSHgAV1k1ABqwegD4s6IAT4m1AH/wPgBEnc0AwuIVAO5lzgDsHIAA8O8QAPZZeAC68JcAMzVvAAVKUwBGXv0AaOoBACuF6QD9uBQAwGpOAEiF1wCq/1kAXLJ4AGP4xgC8uzMAHgMmAF3WXwCssiUAya68AP7FUwAkZqYAqnfsAJkuUgC+08cANBobALJvTgAtK7oAaIIoALfiPgAW5qAAO1YyAM9+owCFIMMAbL82ABfR7wBJrDgASc3DAB8q7AAi/80AxleNALQ+3wARtIIA3D9uAFWiEwBtshQAoPHFAITU8gA1S4EAB8w6ANZxHgBhLBEAx70EADf8KgADzHIAQ4ONAEyVRgAXxdIAoS0hAHkIhwBUeFgAOP1YAM6KtgAJaJ0AuaUnADdSkQDNaVIAJkoIAFVlkAARLYwAc2jBAEHoeQBMnFIAQS8hAKUu2ABZafMAQRGbAElVMgAdHRgA9ImMAF4/NADLcZMAiaXbAB0rpQB1RTEAGqsMAGYPWgAB4nkAEk/2AOg7lQC5bI8A7x5cALOosgDQV7YA8mwTACI31wCjuIAAegycABfkWwBSqBQApdm/AIqmCgBEp3QANDopAHSFjgDOIKgABWL8AOppagBvyq0AXyT+AGvkZwDaq1MA8J0CAO0qCADs3gcAj/T/AFHxnwBnObIAAHr0AGNgYQCyAeoAerH5ANuJsQAZnSwAqPWRABmF5gBKI5IAkQpVAOQq0gCdZxQArSpTAFC4aACZFzgA2vozAKKrjwADOGYAxejeANjGkgAogccAnJtJAHa0iQDNsMQAvkg0AAxqhQABL88A0+rRAGam/AAZaiwAakBeAIkbewAlIpIAMQjsAHKsxAAVPRIAH5HeABuShQBm4ocAtOdpAIvy0QDAdbAAnRZ2AFNL6QCFcQYACIehACvVNgChty8Ah5A8AFc4iwBQwRwAv3PeAO+FjABRt0kAMfNNAMz2/QDaFEEAzLRaAJ5hlQBihAoAP/CjAPH4bAC/fxwAPapOAO3BCQDgg2gA7IyRABgp/AAO+QgAXrMFAHPiZwDc83IAmMzHALPPaAAlyrkAAk6uAD33pwBo0iAAC56eAOolMACgdmQAKdJeAA0UPgBtua8AIH66AJMoxwCYv7UA4JcKAN5c/wDgWDwAcWbUANvmLwD73kIAu/vCAFUiCQB5CJIAxOlxADKN8AB4H8EAh8gnAC8h8QCdBUgAX7cyADXejABFCWYAm7v7AOENigCsVMYAY8UeABEpaADYLmMAOWcMANk9hAANhM8AAQHaAMfmVwB2p2AA5MbYAOw44gCKrqQADZOHAM1RlwBhnvAAGkToADueDQDmbJ0AFYYTAGE6UgDjbEgAeJhCAOOGgAC0s6QANh6iAMu3kQAMMBQAl7YOANsIXwCkd9oA8mqMANf38wCxC7EAv7gjAKa0HwCgqV4ApgI/AIe1oQBaGE8AcxcBAObgYQBMMWwA1G0gAF+J9ABkAl8A2buoAIlKWAA/ZykAl6S0ABtBMQAkyOEAzFtyAHIMdgCCfMgAG9m4ABOX7wBfi/wAeg74AELcSAC7RgEAP1V0AD/FBwABALUAdGX+APlznwBqD1MAfTHIALA+HgDRP/QAaraOANCTrgBWaVUANUQjAFVulwBFlpkAsU3sAN86OACsleQAcFHoANanugC10xgAjD4TAA0g3gDcmx4A/eNDAIsxFAC6N5UAJ7fDAFRwZQD/+pAALV5yACfwHwBzltQA9CAuAD0nQQDbjogAKLenAHydkQDwD+IABvePAF9zWAAvQBwA4Ae3AJk+hQCB0ugAHXjgAOBbKQC4/ksAP4CtAAELZgDZ6kEAO2TIAPH6ZAC80CwAd9CIANrJ3QBbk7QAcT0AAE58HwDa9QMAOYjoABoHGQArjcwADSF4AFNcRgCnkjIAsG/cAC7iCwCh3qEAramDAAYS3gBO0jcA+2p2ADpCZwATvIsAa0FuABWrbwD+0jUA+PYEAPXTnQCnvXQAYtYoAKfT2wCPsNUA0bqlAG1+sQBnnqEA7hvxABQYewBmeO4Ackj6AJhuRADlYpAA9O9TAPSSeACW+ZAAa0nLAErmuAABaxcA+WJsAAJrYgDjOEkAwldNAC3lLwDy81wAoYZzADYpmwC509wAtFJdAIFkwgDiIEsAkyBvAMmSIgDb/sgAjTw2AJzz6QA+0Z8AwXaTAD/3lwB0Kg8A63iFAFe95wARFK8AFOY5AMAmfwB+Rj4AVleaAJNp0wBDKCUAh08qAEy8BwAX0CUAs+xgABUglAD3+TAA8jt9AM83uwBUVaEAvErrACRYKgB8iGkAb5fUAP71dwDEJIoAx7wfAAIduQALb3kAjm+cABeJCADKk10AdfclABorYAC0WOgA167pAGsx/QC8htoA+7auAATccACYfLsAszNLADwo8ACOsr0AdJmfABl+xgD7MQ4Ax2x6AMpK4gBV7FkA0g/QAFmDRQA01bkAFKhtAH9PEwCEoukAV2UiAC2B+wCuwRsA560TAK92ZAABWWcAovTVAPS/6AC+1C8AXCkSAM2NegBYrWQAmozZAE2CIgBAgY4A9YmBAKY0DgD3ZLAAOgXaAOOGSwDofs8AHlvXAN204wCjH2YAlRVHAA2cxwBDjN8AwumLAC5MEwAKK9YAyELrANJYkACbtlYAKfF2AGpW8ACRmC0AWHqZAB1CzwAGY9sA0N9+AOS4igAHJNkACm+yAA+sXwBKUUIAaipZAJuECwDrgV0AFMJpAAKMjgAtdggAJYIXAHDtegAgFIoASxGoALACPgA2KPEASXlaAGIX7QAjLsYA62u0ABm8HQB5dUsATxadAK6qQwD8VEkAd1ARAFOFzADC26QAfe2GANRbdwC7nK8AEwy4AB2XrgDAHIsAZSA6AEo5AgAM8GUAth6kAINTsACbAcEAxoCEAIZGPAD4GlwA3aV9AK7CDgCjga4ArWf0AHD1VQBd2TgA+eGcABMlUACIulIAOzg4AHP9zACB2VIAkyv0ALSeowCib4MA3fyrAMP7+gBVtSMAzpdQAMFI1AATJq8ALcZ1AGvp0gC/4oMAH3/0AFPf7wB5xTwAHeDZAALL8gDOEuQA+iN+AMs3AgCP3lIAs+6FABBzswBwlFkAxPuuAEg6pgCvKoIAU9EoAGAPigBqilYACnYGADJYkQCkihkA7FTKAISADQCODaoAYE04ALH1iwAUi7MAzURTAORgwQCts3wAc78IAFkTXwB+A5UAJiRXAJFADwAjr7MAdjo6ANNvLACcXagA09XGAOzjAwC0GJ0AV3hVAI1RkwAuDVgAtcfaABkNCQAljBgABQNSABEgDQB5kmwAIre6AFs6+wAnad4AT4iAAMSvawA7Fn8AlLC9AOscDABRf54ATp8wAMzgnwD29YQASW0XAEj2NwDw2U4A9NokAMTdYQBw+5UAgxCpAEwmpwCyDPwANRUYALHKyQB5mGsA1yJ8AJqjDQCaHDEAMtJrAEvLIQCDVUoAwGn3AETZ3wCLIwEAeJNzAMkj8AAUk2wAe+YVAOVR8wDCzpcAu4jkACv7dAA3vOgApBWtAO+tkAD8tu8Ac7noACsS7QAXfvMA7mjTACJc9QCea+gAx2jFALywtACyxdUA7r2wANGY2wD4JvYAg5VOANb0ggDtytkA8WGyAHMOtwA0vqAAwO5NAJSJDAAUaRUAoDvEAIfetwA9PqoA1jC3AA61XADx70MA7fFUAPQtRgBpiV0AP2XDAKNQvgCyW6UAJ9esADvTdQBm6f4AF1lDADTKvgCXNQQA6SFtAEuSVQBsXjUAmGbSANERuABhSpUAD2OJAGLtFABRMFUA0IDAAPc3TwCtToMASSGaAMDpVwCjm40At6keAG6chAAgkRAAz7GGAG8lHQA7qgwA8BucAMnEEQDEC+4A9g4MALMwnwAEFpMAqzf0AK8BoAA6L6sA0l0OACWT/gCVqp8AfumWABzjDQCtsygAHG0JAHebagCmi2EAztDRALUodwCq1+sAEcGyAGmDQQAVnXMAxMu8APC5wACRds0AzdJ4AEUdzwD/LLAAUdAQADW6IQBIUcUAXGxOAHdGZAARzd8AA7Y5ADE7cABegAcA0eDuAMBHYwA6skcARPfCAEYMxwB2/g8APBr5AFNusABVe1kAw4+OAOxwgwB7LiwAOltxAI0eAwALkk4AG9EZAESUzgD9fdQA4YOFAJVkHACkj4MAsWJxABeFJABHocwATeLwAG+OuQDdhzIAabHNAPogKwCTMKQAkanLAAsZLQDFv6YAXjQFAK1LdwDK4XsAcM7eAGCurgA7dq8AgD8dAHK87QDpwi8AwH3WAM/BcgBW7sAAyUeVAGw91wCHzM8Aa5fYABuR9QBhOk8Ay+OSAGYDiwAHCJAAYjifABxdQABItm0Ame2tAE/4XABIC6sA0aPxAAwi2ACitbQAtsWpAA+jPwB2lCgAqaATAMx3JADF2o4A6fhSABNVmwC6giQAYfj6AD0dkwBkmecAU5sTANWMgwD7D+cAp9QWAI6+QQAkZvcAkvGvAMaNOgAtsuEAF+LgADEdxgDAc9MA7+36APqe/wD41wQAIIDKAHsx1gATEKgAnWdaAFgB0wAyMAEAxTsPADTrDACBAuMALov9APMo1wB1wawAlCj7AP3EbAD1lDQA3xUvAAPdwABvPXQAwPeDAGxwkQAaAUEAbJQ2ACGgEQBn8XAAuu81AKaQhgAzfIQAkp8jADQ4TQBSSaIALjCgAJuAjQBP8AsAHL5SAKmH7ACyx5cAP/VjAG71zgCuL+IAV2JLAN+yFgA7QvgAG0HdAFO6AwCx+AwArlawAB83cABUNtcAe9LbACB2gAAZVTUA4DRYAEFV4wByz2QAWUgkALXS9ACCaEYAxjjiAI0qiAArChIAr7twAPvaOwDhyfkAEoYVAIM5KABarEsAol47AIBNdQDfMHQAN8GNADM6XwBbJFMAMAEbALILpgCxRIsA3mxlAGqpZACd9SkA9uwTABtT4ABUZDIA3cxyAGnKygA3zW4Age3TANrX0QBc2KEAAab2AEQksQDabWAAdmSYAOBdUwDsLkgAOa4fAPi45QAjr5gAZvEs"
+    var audio=new Audio(src)
+    audio.onended = finish;
+    audio.onerror = finish;
+    try{audio.play()}catch(e){}
+    try{audio.preload=1}catch(e){}
+    try{audio.muted=1}catch(e){}
+    try{audio.playbackRate=567312.2079031984}catch(e){}
+  </script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1517199.html b/dom/media/test/crashtests/1517199.html
new file mode 100644
index 0000000000..10c994f845
--- /dev/null
+++ b/dom/media/test/crashtests/1517199.html
@@ -0,0 +1,17 @@
+<html class="reftest-wait">
+<head>
+<script>
+(async _ => {
+  const video = document.createElement("video");
+    video.mozCaptureStreamUntilEnded();
+    video.src = "test.mp4";
+    video.playbackRate = 2;
+    await new Promise(r => video.onloadedmetadata = r);
+    video.currentTime = video.duration - 1;
+    await video.play();
+    await new Promise(r => video.onended = r);
+    document.documentElement.removeAttribute("class");
+})();
+</script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1526044.html b/dom/media/test/crashtests/1526044.html
new file mode 100644
index 0000000000..1914dfc2f5
--- /dev/null
+++ b/dom/media/test/crashtests/1526044.html
@@ -0,0 +1,19 @@
+<script>
+  function start () {
+    try { o1 = new AudioContext({}) } catch (e) { }
+    try { o2 = new DynamicsCompressorNode(o1, {}) } catch (e) { }
+    try { o3 = o2.attack } catch (e) { }
+    try { o4 = new XMLHttpRequest({mozAnon: true, mozSystem: true}) } catch (e) { }
+    try { o4.open('GET', '', false) } catch (e) { }
+    try { o4.send() } catch (e) { }
+    for (let i = 0; i < 20; i++) {
+      try { o5 = o1.createGain() } catch (e) { }
+      try { o1.suspend().then(function () { }) } catch (e) { }
+      try { o5.connect(o3) } catch (e) { }
+    }
+    setTimeout('location.reload()', 200)
+  }
+
+  window.addEventListener('load', start)
+</script>
+
diff --git a/dom/media/test/crashtests/1530897.webm b/dom/media/test/crashtests/1530897.webm
new file mode 100644
index 0000000000..ac2224157a
Binary files /dev/null and b/dom/media/test/crashtests/1530897.webm differ
diff --git a/dom/media/test/crashtests/1538727.html b/dom/media/test/crashtests/1538727.html
new file mode 100644
index 0000000000..6371d54383
--- /dev/null
+++ b/dom/media/test/crashtests/1538727.html
@@ -0,0 +1,14 @@
+<script>
+const canvas = document.createElement('canvas')
+const context = canvas.getContext('2d', {})
+const xhr = new XMLHttpRequest({})
+const stream = canvas.captureStream(new Float64Array([1593177632.1689904])[0])
+recorder = new MediaRecorder(stream)
+recorder.start(100)
+xhr.open('G', '', false)
+xhr.send()
+recorder.stop()
+tracks = stream.getVideoTracks()
+track = tracks[(1051736525 % tracks.length)]
+stream.removeTrack(track)
+</script>
diff --git a/dom/media/test/crashtests/1545133.html b/dom/media/test/crashtests/1545133.html
new file mode 100644
index 0000000000..fb7039aae3
--- /dev/null
+++ b/dom/media/test/crashtests/1545133.html
@@ -0,0 +1,34 @@
+<html class="reftest-wait">
+<head>
+<script>
+const xhr = new XMLHttpRequest()
+
+async function boom () {
+  await new Promise(r => setTimeout(r, 100))
+
+  SpecialPowers.forceCC()
+  SpecialPowers.forceCC()
+  SpecialPowers.forceCC()
+
+  document.documentElement.removeAttribute("class")
+}
+
+function start () {
+  const context = new AudioContext({})
+  const filter = new BiquadFilterNode(context, {})
+  const destination = context.createMediaStreamDestination()
+  const processor = context.createScriptProcessor(8192, 8, 8)
+  processor.connect(filter.Q)
+  processor.disconnect()
+  xhr.open('G', '', false)
+  xhr.send()
+  context.createMediaStreamSource(destination.stream)
+  processor.connect(filter.Q)
+  context.close()
+  context.addEventListener('statechange', boom, true)
+}
+
+document.addEventListener('DOMContentLoaded', start)
+</script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1547784.html b/dom/media/test/crashtests/1547784.html
new file mode 100644
index 0000000000..ee270491f1
--- /dev/null
+++ b/dom/media/test/crashtests/1547784.html
@@ -0,0 +1,33 @@
+<html class="reftest-wait">
+<head>
+    <script>
+      const doc = new Document();
+      const video = document.createElementNS('http://www.w3.org/1999/xhtml', 'video');
+      const source = new MediaSource();
+
+      navigator.requestMediaKeySystemAccess('org.w3.clearkey', [{ '': [{ '': '' }] }])
+        .then(keySystemAccess => {
+          return keySystemAccess.createMediaKeys();
+        }).then(_ => {
+        video.src = URL.createObjectURL(source);
+        source.addEventListener('sourceopen', () => {
+          doc.adoptNode(video);
+        });
+      });
+
+      navigator.requestMediaKeySystemAccess('org.w3.clearkey', [{ '': [{ '': '' }] }])
+        .then(keySystemAccess => {
+          return keySystemAccess.createMediaKeys();
+        }).then(mediaKeys => {
+        return video.setMediaKeys(mediaKeys);
+      }).then(() => {
+        video.src = URL.createObjectURL(source);
+        document.documentElement.removeAttribute("class");
+      }).catch(e => {
+        // Catch JS errors caused by raciness in the test. So long as we're
+        // not crashing we're good.
+        document.documentElement.removeAttribute("class");
+      });
+    </script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1547899.html b/dom/media/test/crashtests/1547899.html
new file mode 100644
index 0000000000..4ffd90c565
--- /dev/null
+++ b/dom/media/test/crashtests/1547899.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+    <script>
+      function start () {
+        const video = document.getElementById('id_0')
+        const stream_1 = new MediaStream()
+        const stream_2 = video.mozCaptureStreamUntilEnded()
+        const track = stream_2.getTracks()[0]
+
+        video.srcObject = stream_1
+        stream_1.addTrack(track)
+      }
+
+      window.addEventListener('load', start)
+    </script>
+</head>
+<body>
+<video id="id_0" src="data:audio/mpeg;base64,ZQr/+1DEAAAAAAAAAAAAAAAAAAAAAABJbmZvAAAADwAAAAsAAAnKABcXFxcXFxcXFy4uLi4uLi4uLkVFRUVFRUVFRV1dXV1dXV1dXXR0dHR0dHR0dIuLi4uLi4uLi6KioqKioqKiorq6urq6urq6utHR0dHR0dHR0ejo6Ojo6Ojo6P///////////wAAADlMQU1FMy45OHIBpQAAAAAuHQAAFEAkBElCAABAAAAJyuGI2MQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA//tQxAAABmQjXHSRAAH6IfB3OVIDAADLlmjIxWKxWTyIABgmGydGjRox4f8Tg+D4OAgc/BwEDn+UBD+qwH/+8Tny7///KO4IYDgcDgcDgcDgcCgQAAAKKBUFc/nnP30a5O0zyYzMNMkzKlPva2GXgMIBbwDQEAYDQNXGLT2EIgEhoFnQNDb4BAPD9wTFYGJBWJw/8AUWgMBQgIEg4KmAKGP/wRG0csCIWDaQxcFhYvv/8WYMUpEIkXhvnRef//kmsuLPH5OvSoAFKxrJIm26DP/7UsQ">
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1560215.html b/dom/media/test/crashtests/1560215.html
new file mode 100644
index 0000000000..1b76e218d7
--- /dev/null
+++ b/dom/media/test/crashtests/1560215.html
@@ -0,0 +1,20 @@
+<html class="reftest-wait">
+<head>
+    <script>
+      async function start () {
+        const canvas = document.createElement('canvas')
+        const context = canvas.getContext('2d')
+        context.fillStyle = "red"
+        context.fillRect(0, 0, 1, 1)
+        const recorder = new MediaRecorder(
+          canvas.captureStream(), { videoBitsPerSecond: 16 })
+        recorder.start(100)
+        await new Promise(r => recorder.onstart = r)
+        recorder.pause()
+        document.documentElement.removeAttribute("class")
+      }
+
+      window.addEventListener('load', start)
+    </script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1569645.html b/dom/media/test/crashtests/1569645.html
new file mode 100644
index 0000000000..b1f1247f26
--- /dev/null
+++ b/dom/media/test/crashtests/1569645.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+    <script>
+      function start () {
+        const canvas = document.getElementById("c")
+        canvas.getContext("2d")
+        const video = canvas.captureStream()
+        const ac = new AudioContext()
+        const dest = ac.createMediaStreamDestination()
+        const recorder = new MediaRecorder(
+          new MediaStream([...video.getTracks(), ...dest.stream.getTracks()]), {
+            'mimeType': 'audio/ogg'
+          })
+        recorder.start()
+      }
+
+      window.addEventListener('load', start)
+    </script>
+</head>
+<body>
+<canvas id="c"></canvas>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1575271.html b/dom/media/test/crashtests/1575271.html
new file mode 100644
index 0000000000..ceda986553
--- /dev/null
+++ b/dom/media/test/crashtests/1575271.html
@@ -0,0 +1,25 @@
+<html class="reftest-wait">
+<head>
+<script>
+  async function start () {
+    const canvas = document.createElement("canvas")
+    const context = canvas.getContext("2d")
+    context.fillStyle = "blue"
+    context.fillRect(0, 0, canvas.width, canvas.height)
+    const stream = canvas.captureStream()
+    const track = stream.getTracks()[0]
+    const recorder = new MediaRecorder(stream)
+    recorder.start()
+    await new Promise(r => recorder.onstart = r)
+    recorder.pause()
+    stream.removeTrack(track)
+    recorder.resume()
+    await new Promise(r => recorder.onstop = r)
+    document.documentElement.removeAttribute("class")
+  }
+
+  window.addEventListener('load', start)
+</script>
+</head>
+</html>
+
diff --git a/dom/media/test/crashtests/1577184.html b/dom/media/test/crashtests/1577184.html
new file mode 100644
index 0000000000..a38c4a1265
--- /dev/null
+++ b/dom/media/test/crashtests/1577184.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+<script>
+function start () {
+  const frame = document.createElementNS('http://www.w3.org/1999/xhtml', 'frame')
+  document.documentElement.appendChild(frame)
+  frame.contentWindow.eval('window.top.context=new AudioContext()')
+  document.documentElement.innerHTML = ''
+  context.createMediaElementSource(new Audio(''))
+}
+
+document.addEventListener('DOMContentLoaded', start)
+</script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1587248.html b/dom/media/test/crashtests/1587248.html
new file mode 100644
index 0000000000..10c555e2b1
--- /dev/null
+++ b/dom/media/test/crashtests/1587248.html
@@ -0,0 +1,23 @@
+<html class="reftest-wait">
+<head>
+<script>
+function start () {
+  const audio = document.getElementById('id_4')
+  const doc = new Document()
+  const stream = new MediaStream()
+  const track = document.createElementNS('http://www.w3.org/1999/xhtml', 'track')
+  audio.srcObject = stream
+  track.textContent = '�'
+  setTimeout(() => {
+    track.replaceChild(audio, track.childNodes[0])
+    audio.play().then(function (arg4) { })
+    document.documentElement.removeAttribute("class")
+  }, 157)
+  doc.adoptNode(audio)
+}
+
+document.addEventListener('DOMContentLoaded', start)
+</script>
+</head>
+<audio class="" id="id_4" itemscope></audio>
+</html>
diff --git a/dom/media/test/crashtests/1594466.html b/dom/media/test/crashtests/1594466.html
new file mode 100644
index 0000000000..276c5fe3d1
--- /dev/null
+++ b/dom/media/test/crashtests/1594466.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+<script>
+function start() {
+  const ac = new AudioContext();
+  const {stream: audioStream} = ac.createMediaStreamDestination();
+  const [audioTrack] = audioStream.getTracks();
+  const canvas = document.createElement("canvas");
+  const ctx = canvas.getContext("2d");
+  const [videoTrack] = canvas.captureStream().getTracks();
+
+  const rec = new MediaRecorder(new MediaStream([audioTrack, videoTrack]), {
+    mimeType: 'video/webm; codecs="vp8, opus"'
+  });
+  rec.start();
+}
+
+document.addEventListener('DOMContentLoaded', start)
+</script>
+</head>
+</html>
+
diff --git a/dom/media/test/crashtests/1601385.html b/dom/media/test/crashtests/1601385.html
new file mode 100644
index 0000000000..7192809076
--- /dev/null
+++ b/dom/media/test/crashtests/1601385.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+<script>
+const video = document.createElement("video");
+video.srcObject = new MediaStream();
+video.mozCaptureStreamUntilEnded();
+video.src = "sound.ogg";
+video.srcObject = undefined;
+</script>
+</head>
+</html>
+
diff --git a/dom/media/test/crashtests/1601422.html b/dom/media/test/crashtests/1601422.html
new file mode 100644
index 0000000000..9ff3c1a07a
--- /dev/null
+++ b/dom/media/test/crashtests/1601422.html
@@ -0,0 +1,20 @@
+<html class="reftest-wait">
+<head>
+<script>
+(async _ => {
+  try {
+    const video = document.createElement('video')
+    video.preload = 'metadata'
+    video.src = 'sound.ogg'
+    await new Promise(r => video.onloadedmetadata = r)
+    const stream_1 = video.mozCaptureStreamUntilEnded()
+    video.src = ''
+    const stream_2 = video.mozCaptureStreamUntilEnded()
+  } finally {
+    document.documentElement.removeAttribute("class")
+  }
+})()
+</script>
+</head>
+</html>
+
diff --git a/dom/media/test/crashtests/1604941.html b/dom/media/test/crashtests/1604941.html
new file mode 100644
index 0000000000..5a9265ea1b
--- /dev/null
+++ b/dom/media/test/crashtests/1604941.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+async function boom()
+{
+  await SpecialPowers.pushPrefEnv({"set": [
+    ["media.cubeb.force_null_context", true],
+  ]});
+  new Audio().mozCaptureStreamUntilEnded();
+  var ac = new window.AudioContext();
+  ac.resume();
+  ac.close();
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
+
diff --git a/dom/media/test/crashtests/1608286.html b/dom/media/test/crashtests/1608286.html
new file mode 100644
index 0000000000..9f52605be6
--- /dev/null
+++ b/dom/media/test/crashtests/1608286.html
@@ -0,0 +1,50 @@
+<html class="reftest-wait">
+<head>
+  <script>
+    function test() {
+      function checkResolve(value) {
+        // Let the test timeout and fail
+        throw new Error("This promise should not resolve");
+      }
+
+      function checkReject(reason) {
+        if (reason.message !== "Browsing context is no longer available") {
+          // Let the test timeout and fail
+          throw new Error("Unexpected rejected promise reason");          
+        }
+        // Otherwise, successfully rejected a request not attached to a
+        // window without crashing
+      }
+
+      var i = document.querySelector("iframe");
+      var nav = i.contentWindow.navigator;
+      i.remove();
+
+      // First, check with valid args
+      nav.requestMediaKeySystemAccess(
+        "com.widevine.alpha",
+        [{
+            initDataTypes: ["webm"],
+            videoCapabilities: [{ contentType: 'video/webm; codecs="vp9"' }]
+        }]
+      ).then(
+        checkResolve,
+        (reason) => {
+          checkReject(reason);
+
+          // Then, check with invalid args
+          nav.requestMediaKeySystemAccess("", []).then(
+            checkResolve,
+            (reason) => {
+              checkReject(reason);
+              document.documentElement.removeAttribute("class");
+            }
+          );
+        });
+    }
+  </script>
+</head>
+<body onload="test()">
+  <iframe></iframe>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1673525.html b/dom/media/test/crashtests/1673525.html
new file mode 100644
index 0000000000..51de202999
--- /dev/null
+++ b/dom/media/test/crashtests/1673525.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+  <script>
+    document.addEventListener("DOMContentLoaded", () => {
+      const audio = document.getElementById("audio");
+      audio.autoplay = true;
+      audio.mozCaptureStream();
+    })
+  </script>
+</head>
+<body>
+  <!-- The data URL is crafted from a fuzzed mp3 so the base64 can be decoded back to an mp3 as needed -->
+  <audio id="audio" src="data:audio/mpeg;base64,//tQxAAAAAAAAAAAAAAAAAAAAAAASW5mbwAAAA8AAAALAAAJygAXFxcXFxcXFxcuLi4uLi4uLi5FRUVFRUVFRUVdXV1dXV1dXV10dHR0dHR0dHSLi4uLi4uLi4uioqKioqKioqK6urq6urq6urrR0dHR0dHR0dHo6Ojo6Ojo6Oj///////////8AAAA5TEFNRTMuOThyAaUAAAAALh0AABRAJARJQgAAQAAACcrhiNjEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP/7UMQAAAZkI1x0kQAB+iHwdzlSAwAAy5ZoyMVisVk8iAAYJhsnRo0aMeH/E4Pg+DgIHPwcBA5/lAQ/qsB//vE58u///yjuCGA4HA4HA4HA4HAoEAAACigVBXP55z99GuTtM8mMzDTJMypT72thl4DCAW8A0BAGA0DVxi09hCIBIaBZ0DQ2+AQDw/cExWBiQVicP/AFFoDAUICBIOCpgChj/8ERtHLAiFg2kMXBYWL7//FmDFKRCJF4b50Xn//5JrLizx+Tr0qABSsaySJtugz/+1LEBIALgQmLvLUAMXkorjzSjuWd/+FbPOduga79Dhef0OFYNhp+FEPDPRyRvOEERl/Uwbv9F/UuQN5yt9WPM5xwqlB4+hzmfmoYmcceWPD8s3WA8FhYEPkhR0SgMHw="></audio>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1673526-1.html b/dom/media/test/crashtests/1673526-1.html
new file mode 100644
index 0000000000..925dbae6ab
--- /dev/null
+++ b/dom/media/test/crashtests/1673526-1.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+<script>
+window.addEventListener('load', async () => {
+  const frame = document.createElement('frame')
+  document.documentElement.appendChild(frame)
+  const pc = new RTCPeerConnection({})
+  await pc.createOffer({ 'offerToReceiveAudio': true })
+  const [{receiver}] = pc.getTransceivers()
+  const track = pc.addTrack(receiver.track)
+  pc.removeTrack(track)
+  const [track2] = (await frame.contentWindow.navigator.mediaDevices.getUserMedia({
+    'audio': {},
+    'fake': true
+  })).getTracks()
+  pc.addTrack(track2)
+})
+</script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1673526-2.html b/dom/media/test/crashtests/1673526-2.html
new file mode 100644
index 0000000000..ddae9520fc
--- /dev/null
+++ b/dom/media/test/crashtests/1673526-2.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+<script>
+window.addEventListener('load', async () => {
+  const frame = document.createElement('frame')
+  document.documentElement.appendChild(frame)
+  const pc = new RTCPeerConnection({})
+  await pc.createOffer({ 'offerToReceiveAudio': true })
+  const [{sender, receiver}] = pc.getTransceivers()
+  await sender.replaceTrack(receiver.track)
+  await sender.replaceTrack(null)
+  const stream = await frame.contentWindow.navigator.mediaDevices.getUserMedia({
+    'audio': {},
+    'fake': true
+  })
+  await sender.replaceTrack(stream.getTracks()[0])
+})
+</script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1693043.html b/dom/media/test/crashtests/1693043.html
new file mode 100644
index 0000000000..f73323bbd7
--- /dev/null
+++ b/dom/media/test/crashtests/1693043.html
@@ -0,0 +1,21 @@
+<html class="reftest-wait">
+<head>
+<script>
+async function boom() {
+  const audio = document.createElement("audio");
+  audio.preload = "metadata";
+  audio.src = "sound.ogg";
+  await new Promise(r => audio.onloadedmetadata = r);
+  const s = audio.mozCaptureStream();
+  const recorder = new MediaRecorder(
+      new MediaStream(s.getTracks()),
+      { audioBitsPerSecond: 3994678619 }
+    );
+  recorder.start();
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body onload="boom()">
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1696511.html b/dom/media/test/crashtests/1696511.html
new file mode 100644
index 0000000000..de66fa3a67
--- /dev/null
+++ b/dom/media/test/crashtests/1696511.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html class='reftest-wait'>
+<head>
+<script>
+document.addEventListener('DOMContentLoaded', async () => {
+  const canvas = document.createElement('canvas')
+  canvas.height = 27530
+  const context = canvas.getContext('2d')
+  context.strokeRect(5, 5, canvas.width - 5, canvas.height - 5)
+  const stream = canvas.captureStream()
+  const recorder = new MediaRecorder(stream)
+  recorder.start()
+  const stopped = new Promise(r => recorder.onstop = r)
+  await new Promise(r => setTimeout(r, 100))
+  stream.getTracks().forEach(t => t.stop())
+  await stopped
+  document.documentElement.removeAttribute("class")
+})
+</script>
+</head>
+</html>
+
diff --git a/dom/media/test/crashtests/1697521.html b/dom/media/test/crashtests/1697521.html
new file mode 100644
index 0000000000..b44c02e227
--- /dev/null
+++ b/dom/media/test/crashtests/1697521.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+<script>
+async function boom() {
+  const canvas = document.createElement("canvas");
+  canvas.getContext("2d");
+  const recorder = new MediaRecorder(new MediaStream([
+    ...canvas.captureStream().getTracks(),
+    ...canvas.captureStream().getTracks(),
+  ]));
+  recorder.start();
+  recorder.requestData();
+}
+</script>
+</head>
+<body onload="boom()">
+</body>
+</html>
+
diff --git a/dom/media/test/crashtests/1708790.html b/dom/media/test/crashtests/1708790.html
new file mode 100644
index 0000000000..ee97a31c81
--- /dev/null
+++ b/dom/media/test/crashtests/1708790.html
@@ -0,0 +1,22 @@
+<html class="reftest-wait">
+<head>
+<script>
+(async _ => {
+  try {
+    const audio = document.createElement('audio');
+    audio.src = 'sound.ogg';
+    const ac = new AudioContext();
+    const src = ac.createMediaElementSource(audio);
+    src.connect(ac.destination);
+    await audio.play();
+    audio.pause();
+    audio.volume = 0.5;
+    audio.playbackRate = 0.5;
+    audio.preservesPitch = false;
+  } finally {
+    document.documentElement.removeAttribute("class")
+  }
+})()
+</script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1709130.html b/dom/media/test/crashtests/1709130.html
new file mode 100644
index 0000000000..2c6d7dc690
--- /dev/null
+++ b/dom/media/test/crashtests/1709130.html
@@ -0,0 +1,19 @@
+<html class="reftest-wait">
+<head>
+<script>
+(async _ => {
+  const video = document.createElement("video");
+    video.mozCaptureStreamUntilEnded();
+    video.src = "test.mp4";
+    await video.play();
+    for (let i = 0; i < 23; i++) {
+      console.log("nop");
+      await video.seekToNextFrame();
+      video.removeAttribute("readonly");
+    }
+    setTimeout("self.close()", 100);
+    document.documentElement.removeAttribute("class");
+})();
+</script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1734008.html b/dom/media/test/crashtests/1734008.html
new file mode 100644
index 0000000000..31c8d31dae
--- /dev/null
+++ b/dom/media/test/crashtests/1734008.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <script>
+    window.addEventListener("load", async () => {
+      const object = document.createElementNS("http://www.w3.org/2000/svg", "foreignObject")
+      const video = document.createElementNS("http://www.w3.org/1999/xhtml", "video")
+      document.documentElement.appendChild(video)
+      video.setAttribute("src", "1734008.webm")
+      video.mozCaptureStream()
+      const xhr = new XMLHttpRequest()
+      xhr.open("POST", "FOOBAR", false)
+      xhr.send()
+      const document_0 = new Document()
+      const adopted = document_0.adoptNode(document.documentElement)
+      object.insertBefore(adopted, object.childNodes[(216679474 % object.childNodes.length)])
+      try { await video.play() } catch (e) {}
+      setTimeout("location.reload()", 500)
+    })
+  </script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1734008.webm b/dom/media/test/crashtests/1734008.webm
new file mode 100644
index 0000000000..07d2052879
Binary files /dev/null and b/dom/media/test/crashtests/1734008.webm differ
diff --git a/dom/media/test/crashtests/1741677.html b/dom/media/test/crashtests/1741677.html
new file mode 100644
index 0000000000..0c442e830d
--- /dev/null
+++ b/dom/media/test/crashtests/1741677.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<html class="reftest-wait">
+<script>
+  const script = `
+    navigator.mediaCapabilities.decodingInfo({
+      type: 'file',
+      audio: { contentType: "audio/flac" }
+    }).then(postMessage("done"));
+  `;
+  let worker = new Worker(URL.createObjectURL(new Blob([script])));
+  // Stop test completion and crash from racing each other.
+  worker.onmessage = () => document.documentElement.removeAttribute("class");
+</script>
+</html>
diff --git a/dom/media/test/crashtests/1748272.html b/dom/media/test/crashtests/1748272.html
new file mode 100644
index 0000000000..53953e7c0e
--- /dev/null
+++ b/dom/media/test/crashtests/1748272.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <script>
+    window.addEventListener("load", () => {
+      const audio = new Audio();
+      const context = new AudioContext({ "sampleRate": 15772.7 })
+      context.createMediaElementSource(audio);
+    });
+  </script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1752917.html b/dom/media/test/crashtests/1752917.html
new file mode 100644
index 0000000000..84752a174f
--- /dev/null
+++ b/dom/media/test/crashtests/1752917.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <script>
+    window.addEventListener("load", () => {
+      const context = new AudioContext({})
+      const node = new DelayNode(context, {})
+      const abort = new AbortController()
+      let processor = context.createScriptProcessor(4096, 1, 26)
+      processor.addEventListener("audioprocess", () => {}, { "signal": abort.signal })
+      processor.connect(node.delayTime)
+      processor = undefined
+      SpecialPowers.forceGC()
+      abort.abort(undefined)
+    });
+  </script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1762620.html b/dom/media/test/crashtests/1762620.html
new file mode 100644
index 0000000000..b4c705c84f
--- /dev/null
+++ b/dom/media/test/crashtests/1762620.html
@@ -0,0 +1,8 @@
+<audio id='fuzzed' controls>
+  <source src='fuzzed.wav'>
+</audio>
+<script>
+  var m = document.getElementById('fuzzed')
+  m.addEventListener('canplay', m.play, true)
+</script>
+
diff --git a/dom/media/test/crashtests/1765842.html b/dom/media/test/crashtests/1765842.html
new file mode 100644
index 0000000000..8b77ec998a
--- /dev/null
+++ b/dom/media/test/crashtests/1765842.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+  <video src="1765842.webm" type="video/webm" autoplay="true" controls></video>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1765842.webm b/dom/media/test/crashtests/1765842.webm
new file mode 100644
index 0000000000..62eb5d779d
Binary files /dev/null and b/dom/media/test/crashtests/1765842.webm differ
diff --git a/dom/media/test/crashtests/1787281.html b/dom/media/test/crashtests/1787281.html
new file mode 100644
index 0000000000..e5586dbf2f
--- /dev/null
+++ b/dom/media/test/crashtests/1787281.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+</head>
+<body>
+  <video id=a src="1787281.mp4" autoplay="true" controls></video>
+  <script>
+    a.onended = function() {
+      document.documentElement.className = "";
+    }
+  </script>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1787281.mp4 b/dom/media/test/crashtests/1787281.mp4
new file mode 100644
index 0000000000..8481cf034c
Binary files /dev/null and b/dom/media/test/crashtests/1787281.mp4 differ
diff --git a/dom/media/test/crashtests/1798778.html b/dom/media/test/crashtests/1798778.html
new file mode 100644
index 0000000000..300d84afa1
--- /dev/null
+++ b/dom/media/test/crashtests/1798778.html
@@ -0,0 +1,11 @@
+<html class="reftest-wait">
+<head>
+<audio id=a src="adts-truncated.aac" controls></audio>
+<script>
+  a.play();
+  a.onerror = function() {
+    document.documentElement.removeAttribute("class");
+  }
+</script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1833894.mp4 b/dom/media/test/crashtests/1833894.mp4
new file mode 100644
index 0000000000..a5c20e4846
Binary files /dev/null and b/dom/media/test/crashtests/1833894.mp4 differ
diff --git a/dom/media/test/crashtests/1833896.mp4 b/dom/media/test/crashtests/1833896.mp4
new file mode 100644
index 0000000000..6d40590c8a
Binary files /dev/null and b/dom/media/test/crashtests/1833896.mp4 differ
diff --git a/dom/media/test/crashtests/1835164.html b/dom/media/test/crashtests/1835164.html
new file mode 100644
index 0000000000..702e082954
--- /dev/null
+++ b/dom/media/test/crashtests/1835164.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<audio id=a src=1835164.opus controls autoplay></audio>
+<script>
+a.onloadedmetadata = function() {
+  a.currentTime = 1e40;
+  a.play();
+}
+a.onplaying = function() {
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</html>
diff --git a/dom/media/test/crashtests/1835164.opus b/dom/media/test/crashtests/1835164.opus
new file mode 100644
index 0000000000..124fdbfda1
Binary files /dev/null and b/dom/media/test/crashtests/1835164.opus differ
diff --git a/dom/media/test/crashtests/1840002.webm b/dom/media/test/crashtests/1840002.webm
new file mode 100644
index 0000000000..0ad6d513e7
Binary files /dev/null and b/dom/media/test/crashtests/1840002.webm differ
diff --git a/dom/media/test/crashtests/1845350.mp4 b/dom/media/test/crashtests/1845350.mp4
new file mode 100644
index 0000000000..e22af449c2
Binary files /dev/null and b/dom/media/test/crashtests/1845350.mp4 differ
diff --git a/dom/media/test/crashtests/255ch.wav b/dom/media/test/crashtests/255ch.wav
new file mode 100644
index 0000000000..d9ee36d5bf
Binary files /dev/null and b/dom/media/test/crashtests/255ch.wav differ
diff --git a/dom/media/test/crashtests/459439-1.html b/dom/media/test/crashtests/459439-1.html
new file mode 100644
index 0000000000..7bb0131d51
--- /dev/null
+++ b/dom/media/test/crashtests/459439-1.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+var i = 0;
+function boom()
+{
+  var div = document.getElementById("div");
+  var audio = document.getElementById("audio");
+
+  audio.onload = null;
+
+  div.textContent = "FAIL";
+  audio.src += "";
+  div.textContent = "PASS?";
+
+  ++i;
+
+  setTimeout(done, 1);
+}
+
+function done()
+{
+  // Note we reset 'src' to release decoder resources and cubeb streams to
+  // prevent OOM or OpenCubeb() failures.
+  var audio = document.getElementById("audio");
+  audio.src = "";
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body>
+<audio id="audio" autoplay src="sound.ogg" oncanplaythrough="setTimeout(boom, 1);"></audio>
+<div id="div"></div>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/466607-1.html b/dom/media/test/crashtests/466607-1.html
new file mode 100644
index 0000000000..e154223efe
--- /dev/null
+++ b/dom/media/test/crashtests/466607-1.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.body.appendChild(document.createElementNS("bar", "audio"));
+  document.body.appendChild(document.createElementNS("bar", "video"));
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/media/test/crashtests/466945-1.html b/dom/media/test/crashtests/466945-1.html
new file mode 100644
index 0000000000..ac1ba29e36
--- /dev/null
+++ b/dom/media/test/crashtests/466945-1.html
@@ -0,0 +1,25 @@
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+
+var s;
+
+function boom()
+{
+  s = document.createElement("span");
+  s.innerHTML = "<video src='data:text/html,' autoplay='autoplay'><\/video>";
+  document.body.appendChild(document.createElement("iframe"));
+  setTimeout(boom2, 0);
+}
+
+function boom2()
+{
+  s.innerHTML = "";
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 0);"></body>
+</html>
diff --git a/dom/media/test/crashtests/468763-1.html b/dom/media/test/crashtests/468763-1.html
new file mode 100644
index 0000000000..d21e5bc388
--- /dev/null
+++ b/dom/media/test/crashtests/468763-1.html
@@ -0,0 +1 @@
+<html><head></head><body><video src="nosuchprotocol:"></video></body></html>
\ No newline at end of file
diff --git a/dom/media/test/crashtests/474744-1.html b/dom/media/test/crashtests/474744-1.html
new file mode 100644
index 0000000000..8a7c70cf05
--- /dev/null
+++ b/dom/media/test/crashtests/474744-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.body.innerHTML += "<video src='aim:yaz'><\/video>";
+}
+
+</script>
+</head>
+<body onload="boom();">
+</body>
+</html>
diff --git a/dom/media/test/crashtests/481136-1.html b/dom/media/test/crashtests/481136-1.html
new file mode 100644
index 0000000000..bd264058d9
--- /dev/null
+++ b/dom/media/test/crashtests/481136-1.html
@@ -0,0 +1,3 @@
+<html>
+<div><object data='sound.ogg'></div>
+</html>
diff --git a/dom/media/test/crashtests/492286-1.xhtml b/dom/media/test/crashtests/492286-1.xhtml
new file mode 100644
index 0000000000..627ac38723
--- /dev/null
+++ b/dom/media/test/crashtests/492286-1.xhtml
@@ -0,0 +1 @@
+<source xmlns="http://www.w3.org/1999/xhtml"/>
\ No newline at end of file
diff --git a/dom/media/test/crashtests/493915-1.html b/dom/media/test/crashtests/493915-1.html
new file mode 100644
index 0000000000..2a6ae9bd6c
--- /dev/null
+++ b/dom/media/test/crashtests/493915-1.html
@@ -0,0 +1,18 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  s = document.createElement("span");
+  a = document.createElement("audio");
+  a['src'] = "javascript:4";
+  a['loopend'] = 3;
+  s.appendChild(a);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/media/test/crashtests/495794-1.html b/dom/media/test/crashtests/495794-1.html
new file mode 100644
index 0000000000..2db69206a1
--- /dev/null
+++ b/dom/media/test/crashtests/495794-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+  <body>
+    <audio src="495794-1.ogg" autoplay onended="this.src=''; document.documentElement.className=undefined"></audio>
+    <!-- Note we reset 'src' to release decoder resources and cubeb streams to prevent OOM or OpenCubeb() failures. -->
+  </body>
+</html>
+
diff --git a/dom/media/test/crashtests/495794-1.ogg b/dom/media/test/crashtests/495794-1.ogg
new file mode 100644
index 0000000000..1c19a64061
Binary files /dev/null and b/dom/media/test/crashtests/495794-1.ogg differ
diff --git a/dom/media/test/crashtests/497734-1.xhtml b/dom/media/test/crashtests/497734-1.xhtml
new file mode 100644
index 0000000000..6df055da39
--- /dev/null
+++ b/dom/media/test/crashtests/497734-1.xhtml
@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+
+  div = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+  div.appendChild(document.getElementById("v"));
+  document.body.appendChild(div);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<video id="v"><source></source></video>
+
+</body>
+</html>
diff --git a/dom/media/test/crashtests/497734-2.html b/dom/media/test/crashtests/497734-2.html
new file mode 100644
index 0000000000..990ac4af46
--- /dev/null
+++ b/dom/media/test/crashtests/497734-2.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<script>
+
+function boom()
+{
+    audio1 = document.createElement("audio");
+    (audio1).appendChild(document.createElement("source"));
+    (audio1).appendChild(document.createElement("source"));
+    setTimeout(function() {
+        audio2 = document.createElement("audio");
+        audio2.appendChild(audio1);
+    }, 100);
+}
+
+</script>
+<body onload="boom();"></body>
diff --git a/dom/media/test/crashtests/576612-1.html b/dom/media/test/crashtests/576612-1.html
new file mode 100644
index 0000000000..04f993e780
--- /dev/null
+++ b/dom/media/test/crashtests/576612-1.html
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+
+  var v = document.getElementById("v");
+  v.src = "data:text/plain,_";
+  document.documentElement.appendChild(v);
+
+}
+</script>
+</head>
+<body onload="boom();"><video id="v" src="data:video/ogg;codecs=&quot;theora,vorbis&quot;,1"></video></body>
+</html>
diff --git a/dom/media/test/crashtests/691096-1.html b/dom/media/test/crashtests/691096-1.html
new file mode 100644
index 0000000000..3c3ebfc12a
--- /dev/null
+++ b/dom/media/test/crashtests/691096-1.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head> 
+<script>
+var ITERATIONS = 200;
+
+function stoptest (evt)
+{
+   if (evt) {
+     // Note we reset 'src' to release decoder resources and cubeb streams to
+     // prevent OOM or OpenCubeb() failures.
+     evt.target.src = "";
+   }
+   document.documentElement.removeAttribute("class");
+}
+
+function boom()
+{
+    for (var i = 0; i < ITERATIONS; ++i) {
+        a = document.createElementNS("http://www.w3.org/1999/xhtml", "audio");
+        a.addEventListener("loadedmetadata", stoptest);
+        a.setAttributeNS(null, "autoplay", "");
+        a.setAttributeNS(null, "src", "sound.ogg");
+    }
+    setTimeout(stoptest, 250);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/media/test/crashtests/752784-1.html b/dom/media/test/crashtests/752784-1.html
new file mode 100644
index 0000000000..4644eeb89a
--- /dev/null
+++ b/dom/media/test/crashtests/752784-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function boom()
+{
+  document.getElementById("a").mozCaptureStream();
+}
+</script>
+</head>
+
+<body onload="boom();">
+<audio id="a" src="sound.ogg">
+</body>
+</html>
diff --git a/dom/media/test/crashtests/789075-1.html b/dom/media/test/crashtests/789075-1.html
new file mode 100644
index 0000000000..6cd673fb75
--- /dev/null
+++ b/dom/media/test/crashtests/789075-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+</head>
+<body>
+<video src="789075.webm" preload="metadata" id="v">
+</video>
+<!-- Note we reset 'src' to release decoder resources and cubeb streams to prevent OOM or OpenCubeb() failures. -->
+<script type="application/javascript">
+  var video = document.getElementById("v");
+  video.onloadeddata = function () {
+    video.play();
+  };
+  video.onended = function () {
+    video.src="";
+    document.documentElement.className = undefined;
+  };
+</script>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/789075.webm b/dom/media/test/crashtests/789075.webm
new file mode 100644
index 0000000000..602e53fca2
Binary files /dev/null and b/dom/media/test/crashtests/789075.webm differ
diff --git a/dom/media/test/crashtests/795892-1.html b/dom/media/test/crashtests/795892-1.html
new file mode 100644
index 0000000000..d73cea7f2e
--- /dev/null
+++ b/dom/media/test/crashtests/795892-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+function boom()
+{
+  var a = document.getElementById("a");
+  a.play();
+  a.onplaying = function () {
+    a.onplaying = null;
+    // Note we reset 'src' to release decoder resources and cubeb streams to
+    // prevent OOM or OpenCubeb() failures.
+    a.src = "";
+    document.documentElement.className = "";
+  }
+}
+</script>
+</head>
+
+<body>
+<video id="a" src="cors.webm" crossorigin preload="metadata" onloadedmetadata="boom();">
+</body>
+</html>
diff --git a/dom/media/test/crashtests/844563.html b/dom/media/test/crashtests/844563.html
new file mode 100644
index 0000000000..a3cb91838d
--- /dev/null
+++ b/dom/media/test/crashtests/844563.html
@@ -0,0 +1,5 @@
+<script>
+var a = document.createElementNS("http://www.w3.org/1999/xhtml", "audio");
+a.preservesPitch = a;
+</script>
+
diff --git a/dom/media/test/crashtests/846612.html b/dom/media/test/crashtests/846612.html
new file mode 100644
index 0000000000..070c375381
--- /dev/null
+++ b/dom/media/test/crashtests/846612.html
@@ -0,0 +1,8 @@
+<script>
+document.addEventListener("DOMContentLoaded", function() {
+  var a = document.querySelector("audio");
+  a.playbackRate = 2;
+  a.play();
+});
+</script>
+<audio src="495794-1.ogg"></audio>
diff --git a/dom/media/test/crashtests/852838.html b/dom/media/test/crashtests/852838.html
new file mode 100644
index 0000000000..0bea29351b
--- /dev/null
+++ b/dom/media/test/crashtests/852838.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+    <head>
+        <script>
+            var o0 = new window.AudioContext();
+            var o1 = o0.createBuffer(536870912, 1, 8192);
+        </script>
+    </head>
+    <body>
+    </body>
+</html>
diff --git a/dom/media/test/crashtests/865004.html b/dom/media/test/crashtests/865004.html
new file mode 100644
index 0000000000..4da39071c4
--- /dev/null
+++ b/dom/media/test/crashtests/865004.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+    var ac = new AudioContext();
+    for (var j = 0; j < 200; ++j) {
+        ac.createScriptProcessor(undefined);
+    }
+    document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/media/test/crashtests/865537-1.html b/dom/media/test/crashtests/865537-1.html
new file mode 100644
index 0000000000..4065eb3608
--- /dev/null
+++ b/dom/media/test/crashtests/865537-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML>
+<html>
+<body onload="doTest()">
+<base href="../unknown">
+<div id="test3"></div>
+<video id="test4"><source src="white.webm"></video>
+<script>
+function doTest() {
+  test3.appendChild(test4);
+}
+</script>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/865550.html b/dom/media/test/crashtests/865550.html
new file mode 100644
index 0000000000..b8626e8d67
--- /dev/null
+++ b/dom/media/test/crashtests/865550.html
@@ -0,0 +1,22 @@
+<html class="reftest-wait">
+    <head>   
+        <script>
+        var i = 0;
+        var interval;
+        function crash() {
+            var o0 = new AudioContext();
+            o1 = o0.createBufferSource();
+            ++i;
+            if (i == 2000) {
+                document.documentElement.removeAttribute("class");
+                clearInterval(interval);
+            } 
+        }
+        function start() {
+            interval = setInterval("crash()", 0)
+        }
+        </script>
+    </head>
+    <body onload="start()">
+    </body>
+</html>
diff --git a/dom/media/test/crashtests/868504.html b/dom/media/test/crashtests/868504.html
new file mode 100644
index 0000000000..94090c1c09
--- /dev/null
+++ b/dom/media/test/crashtests/868504.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+    new AudioContext().createBufferSource().playbackRate.linearRampToValueAtTime(0, -1);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/media/test/crashtests/874869.html b/dom/media/test/crashtests/874869.html
new file mode 100644
index 0000000000..1fe3dbd2fc
--- /dev/null
+++ b/dom/media/test/crashtests/874869.html
@@ -0,0 +1,15 @@
+<script>
+var Context0= new AudioContext()
+var Panner0=Context0.createPanner();
+var BufferSource3=Context0.createBufferSource();
+Panner0.channelCount=0;
+BufferSource3.connect(Panner0);
+BufferSource3.buffer=function(){
+	var length=1;
+	var Buffer=Context0.createBuffer(1,length,'44200');
+	var bufferData= Buffer.getChannelData(0);
+	for (var i = 0; i < length; ++i) { bufferData[i] = 255;};
+	return Buffer;
+}();
+
+</script>
\ No newline at end of file
diff --git a/dom/media/test/crashtests/874915.html b/dom/media/test/crashtests/874915.html
new file mode 100644
index 0000000000..59218b3da3
--- /dev/null
+++ b/dom/media/test/crashtests/874915.html
@@ -0,0 +1,24 @@
+<script>
+var Context0= new AudioContext()
+var BufferSource6=Context0.createBufferSource();
+
+setInterval(function(){
+BufferSource6.buffer=function(){
+	var length=11283;
+	var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+	var bufferData= Buffer.getChannelData(0);
+	for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(624))};
+	return Buffer;
+}();
+},0)
+
+BufferSource6.start(0.15831333969254047,0.23571860056836158,0.529235512483865);
+
+BufferSource6.buffer=function(){
+	var length=48517;
+	var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+	var bufferData= Buffer.getChannelData(0);
+	for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(365))};
+	return Buffer;
+}();
+</script>
\ No newline at end of file
diff --git a/dom/media/test/crashtests/874934.html b/dom/media/test/crashtests/874934.html
new file mode 100644
index 0000000000..350ce28101
--- /dev/null
+++ b/dom/media/test/crashtests/874934.html
@@ -0,0 +1,23 @@
+<script>
+var Context0= new AudioContext()
+var BufferSource0=Context0.createBufferSource();
+BufferSource0.start(0.01932738965842873,0.33345631847623736,0.3893404237460345);
+BufferSource0.buffer=function(){
+	var length=35887;
+	var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+	var bufferData= Buffer.getChannelData(0);
+	for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(0.39765272522345185))};
+	return Buffer;
+}();
+
+BufferSource0.buffer=function(){
+	var length=15952;
+	var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+	var bufferData= Buffer.getChannelData(0);
+	for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(85))};
+	return Buffer;
+}();
+
+BufferSource0.playbackRate.value=20.401213286832185;
+
+</script>
diff --git a/dom/media/test/crashtests/874952.html b/dom/media/test/crashtests/874952.html
new file mode 100644
index 0000000000..a9a398fdb2
--- /dev/null
+++ b/dom/media/test/crashtests/874952.html
@@ -0,0 +1,11 @@
+<script>
+var Context0= new AudioContext()
+var ChannelSplitter0=Context0.createChannelSplitter();
+var BiquadFilter0=Context0.createBiquadFilter();
+var WaveShaper0=Context0.createWaveShaper();
+
+ChannelSplitter0.connect(BiquadFilter0,3,0);
+ChannelSplitter0.connect(WaveShaper0);
+BiquadFilter0.disconnect();
+WaveShaper0.connect(ChannelSplitter0);
+</script>
diff --git a/dom/media/test/crashtests/875144.html b/dom/media/test/crashtests/875144.html
new file mode 100644
index 0000000000..bf5d0d0861
--- /dev/null
+++ b/dom/media/test/crashtests/875144.html
@@ -0,0 +1,81 @@
+<script>
+Logger = {}
+Logger.error = function(e) {}
+Logger.comment = function(e) {}
+
+try { o0 = document.createElement('audio'); } catch(e) { Logger.error(Logger.comment(e)); }
+try { (document.body || document.documentElement).appendChild(o0); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o1 = new AudioContext(); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o2 = o1.createGain(); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o3 = o1.createBufferSource(); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o3.buffer = function() { o4 = o1.createBuffer(1, 3, 52970);
+o5 = o4.getChannelData(0);
+for(var i=0; i<3; ++i) {
+o5[i] = Math.sin(i * 63);
+}
+return o4;
+}(); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o3.buffer = function() { o6 = o1.createBuffer(1, 15, 41218);
+o7 = o6.getChannelData(0);
+for(var i=0; i<15; ++i) {
+o7[i] = Math.sin(i * 0);
+}
+return o6;
+}(); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o3.buffer = function() { o8 = o1.createBuffer(1, 0, 49074);
+o9 = o8.getChannelData(0);
+for(var i=0; i<0; ++i) {
+o9[i] = Math.sin(i * 0);
+}
+return o8;
+}(); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o3.buffer = function() { o10 = o1.createBuffer(1, 31, 86527);
+o11 = o10.getChannelData(0);
+for(var i=0; i<31; ++i) {
+o11[i] = Math.sin(i * 127);
+}
+return o10;
+}(); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o3.stop(-1) } catch(e) { Logger.error(Logger.comment(e)); }
+/* [Exception... "An attempt was made to use an object that is not, or is no longer, usable"  code: "11" nsresult: "0x8053000b (InvalidStateError)"  location: "file:///Users/cdiehl/dev/projects/peach/Peach/Utilities/JS/undefined.js Line: 602"] */
+try { o3.channelCountMode = 'explicit'; } catch(e) { Logger.error(Logger.comment(e)); }
+try { o12 = o1.createBiquadFilter(); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o3.buffer = function() { o13 = o1.createBuffer(1, 63, 28347);
+o14 = o13.getChannelData(0);
+for(var i=0; i<63; ++i) {
+o14[i] = Math.sin(i * 15);
+}
+return o13;
+}(); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o12.channelCount = 1; } catch(e) { Logger.error(Logger.comment(e)); }
+try { o12.connect(GainNode, 65536, 0) } catch(e) { Logger.error(Logger.comment(e)); }
+/* TypeError: Value does not implement interface AudioNode. */
+try { o3.buffer = function() { o15 = o1.createBuffer(1, 1, 72540);
+o16 = o15.getChannelData(0);
+for(var i=0; i<1; ++i) {
+o16[i] = Math.sin(i * 7);
+}
+return o15;
+}(); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o12.getFrequencyResponse(new Float32Array(7), new Float32Array(127), new Float32Array(7)) } catch(e) { Logger.error(Logger.comment(e)); }
+try { o12.getFrequencyResponse(new Float32Array(15), new Float32Array(127), new Float32Array(7)) } catch(e) { Logger.error(Logger.comment(e)); }
+try { o17 = document.createElement('audio'); } catch(e) { Logger.error(Logger.comment(e)); }
+try { (document.body || document.documentElement).appendChild(o0); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o3.buffer = function() { o18 = o1.createBuffer(1, 7, 91261);
+o19 = o18.getChannelData(0);
+for(var i=0; i<7; ++i) {
+o19[i] = Math.sin(i * 7);
+}
+return o18;
+}(); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o12.getFrequencyResponse(new Float32Array(31), new Float32Array(31), new Float32Array(127)) } catch(e) { Logger.error(Logger.comment(e)); }
+try { o20 = o1.createChannelSplitter(1, 2, 4, 16, 32); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o12.channelCountMode = 'explicit'; } catch(e) { Logger.error(Logger.comment(e)); }
+try { o3.buffer = function() { o21 = o1.createBuffer(1, 0, 14451);
+o22 = o21.getChannelData(0);
+for(var i=0; i<0; ++i) {
+o22[i] = Math.sin(i * 63);
+}
+return o21;
+}(); } catch(e) { Logger.error(Logger.comment(e)); }
+</script>
diff --git a/dom/media/test/crashtests/875596.html b/dom/media/test/crashtests/875596.html
new file mode 100644
index 0000000000..7bac09dab7
--- /dev/null
+++ b/dom/media/test/crashtests/875596.html
@@ -0,0 +1,12 @@
+<script>
+try { o1 = new AudioContext(); } catch(e) {  }
+try { o6 = o1.createGain(); } catch(e) {  }
+try { o8 = o1.createBufferSource(); } catch(e) {  }
+try { o6.gain.setValueCurveAtTime(new Float32Array(7), 0, 0) } catch(e) {  }
+try { o8.connect(o6, 0, 0) } catch(e) {  }
+try { o8.buffer = function() { 
+    o19 = o1.createBuffer(1, 1, 76309);
+    for(var i=0; i<1; ++i) { }
+    return o19;
+}(); } catch(e) {  }
+</script>
diff --git a/dom/media/test/crashtests/875911.html b/dom/media/test/crashtests/875911.html
new file mode 100644
index 0000000000..fbc52642b4
--- /dev/null
+++ b/dom/media/test/crashtests/875911.html
@@ -0,0 +1,3 @@
+<script>
+  new OfflineAudioContext(1, 10, 48000);
+</script>
diff --git a/dom/media/test/crashtests/876024-1.html b/dom/media/test/crashtests/876024-1.html
new file mode 100644
index 0000000000..5502d8e42d
--- /dev/null
+++ b/dom/media/test/crashtests/876024-1.html
@@ -0,0 +1,5 @@
+<script>
+o1 = new window.AudioContext(2, 8, 44100);
+o4 = o1.createBiquadFilter();
+o4.detune.setValueAtTime(0.0843, 1.7976931348623157e+308);
+</script>
diff --git a/dom/media/test/crashtests/876024-2.html b/dom/media/test/crashtests/876024-2.html
new file mode 100644
index 0000000000..4b9beb7453
--- /dev/null
+++ b/dom/media/test/crashtests/876024-2.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+  var bufferSource = new AudioContext().createScriptProcessor().context.createBufferSource();
+  bufferSource.start(0, 0, 0);
+  bufferSource.stop(562949953421313);
+}
+
+</script></head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/media/test/crashtests/876118.html b/dom/media/test/crashtests/876118.html
new file mode 100644
index 0000000000..bc0630350a
--- /dev/null
+++ b/dom/media/test/crashtests/876118.html
@@ -0,0 +1,16 @@
+<script>
+var Context0= new AudioContext()
+var BufferSource7=Context0.createBufferSource();
+
+BufferSource7.connect(Context0.destination);
+BufferSource7.buffer=function(){
+	var length=7;
+	var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+	var bufferData= Buffer.getChannelData(0);for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(-1))};
+	return Buffer;
+}();
+
+
+Context0.destination.channelCountMode="explicit";
+Context0.destination.channelCount=519910189000000;
+</script>
diff --git a/dom/media/test/crashtests/876207.html b/dom/media/test/crashtests/876207.html
new file mode 100644
index 0000000000..7bfcb096b2
--- /dev/null
+++ b/dom/media/test/crashtests/876207.html
@@ -0,0 +1,30 @@
+<script>
+try { o1 = new window.OfflineAudioContext(1, 10, 44100); } catch(e) { }
+try { o2 = o1.createChannelSplitter(1); } catch(e) { }
+try { o3 = o1.createAnalyser(); } catch(e) { }
+try { o4 = o1.createWaveShaper(); } catch(e) { }
+try { o5 = o1.createChannelSplitter(6); } catch(e) { }
+try { o6 = o1.createAnalyser(); } catch(e) { }
+try { o7 = o1.createBufferSource(); } catch(e) { }
+try { o7.connect(o1.destination); } catch(e) { }
+try { o7.buffer = function() {
+o8 = o1.createBuffer(1, 3, o1.sampleRate);
+o9 = o8.getChannelData(0);
+for(var i = 0; i < 3; ++i) {
+o9[i] = Math.sin(i * 127);
+}
+return o8;
+}()
+; } catch(e) { }
+try { o7.playbackRate.cancelScheduledValues(0) } catch(e) { }
+try { o7.channelInterpretation = 'speakers'; } catch(e) { }
+try { o1.destination.channelInterpretation = 'speakers'; } catch(e) { }
+try { o5.connect(o1.destination, 1, 1) } catch(e) { }
+try { o1.listener.setOrientation(0, 1073741824, 1073741824, 4194304, 1, 0) } catch(e) { }
+try { o4.curve = new Float32Array(127); } catch(e) { }
+try { o6.getByteFrequencyData(new Uint8Array(12)) } catch(e) { }
+try { o6.disconnect() } catch(e) { }
+try { o1.destination.channelCount = 33554432; } catch(e) { }
+try { o7.playbackRate.setTargetAtTime(0, 8388608, 1) } catch(e) { }
+try { o6.getByteTimeDomainData(new Uint8Array(12)) } catch(e) { }
+</script>
diff --git a/dom/media/test/crashtests/876215.html b/dom/media/test/crashtests/876215.html
new file mode 100644
index 0000000000..07135e3628
--- /dev/null
+++ b/dom/media/test/crashtests/876215.html
@@ -0,0 +1,14 @@
+<script>
+try { o1 = new window.OfflineAudioContext(1, 10, 44100); } catch(e) { }
+try { o6 = o1.createScriptProcessor(0, 0, 2); } catch(e) { }
+try { o8 = o1.createBufferSource(); } catch(e) { }
+try { o8.connect(o1.destination); } catch(e) { }
+try { o8.connect(o6) } catch(e) { }
+try { o3.disconnect() } catch(e) { }
+try { o8.buffer = function() {
+o21 = o1.createBuffer(1, 3, o1.sampleRate);
+o22 = o21.getChannelData(0);
+return o21;
+}()
+; } catch(e) { }
+</script>
diff --git a/dom/media/test/crashtests/876249.html b/dom/media/test/crashtests/876249.html
new file mode 100644
index 0000000000..6f72b40bc1
--- /dev/null
+++ b/dom/media/test/crashtests/876249.html
@@ -0,0 +1,27 @@
+<script>
+var Context0= new AudioContext()
+var BufferSource0=Context0.createBufferSource();
+var BiquadFilter0=Context0.createBiquadFilter();
+BufferSource0.start(0,0.6167310480959713,0.7142638498917222);
+BiquadFilter0.connect(Context0.destination);
+BufferSource0.buffer=function(){
+	var length=86333;
+	var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+	var bufferData= Buffer.getChannelData(0);
+	for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(-1))};
+	return Buffer;
+}();
+
+BufferSource0.connect(BiquadFilter0);
+
+BufferSource0.buffer=function(){
+	var length=21989;
+	var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+	var bufferData= Buffer.getChannelData(0);
+	for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(0))};
+	return Buffer;
+}();
+
+BufferSource0.stop(0.04184641852043569);
+
+</script>
diff --git a/dom/media/test/crashtests/876252.html b/dom/media/test/crashtests/876252.html
new file mode 100644
index 0000000000..cb9cb63ed3
--- /dev/null
+++ b/dom/media/test/crashtests/876252.html
@@ -0,0 +1,23 @@
+<script>
+var Context0= new AudioContext()
+var BufferSource4=Context0.createBufferSource();
+BufferSource4.start(0.05386466556228697,0.397192713804543,0.48810303467325866);
+
+BufferSource4.buffer=function(){
+	var length=109076;
+	var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+	var bufferData= Buffer.getChannelData(0);
+	for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(370))};
+	return Buffer;
+}();
+
+BufferSource4.buffer=function(){
+	var length=19339;
+	var Buffer=Context0.createBuffer(1,length,53362);
+	var bufferData= Buffer.getChannelData(0);
+	for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(-0.16235407581552863))};
+	return Buffer;
+}();
+
+BufferSource4.stop(0.46482366253621876);
+</script>
diff --git a/dom/media/test/crashtests/876834.html b/dom/media/test/crashtests/876834.html
new file mode 100644
index 0000000000..f4ca6ee558
--- /dev/null
+++ b/dom/media/test/crashtests/876834.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+new OfflineAudioContext(0, 0, 3229622);
+</script>
diff --git a/dom/media/test/crashtests/877527.html b/dom/media/test/crashtests/877527.html
new file mode 100644
index 0000000000..c639d501b7
--- /dev/null
+++ b/dom/media/test/crashtests/877527.html
@@ -0,0 +1,37 @@
+<script>
+try { o1 = new window.AudioContext(2, 5, 44100); } catch(e) { }
+try { o2 = o1.createChannelMerger(1); } catch(e) { }
+try { o3 = o1.createDelay(10); } catch(e) { }
+try { o4 = o1.createBuffer(2, 2048, 8000); } catch(e) { }
+try { o5 = o1.createPanner(); } catch(e) { }
+try { o6 = o1.createBufferSource(); } catch(e) { }
+try { o7 = (function() {
+var buf = o1.createBuffer(1, 50000, o1.sampleRate);
+for(var j=0; j<1; ++j) {
+for(var i=0; i<50000; ++i) { buf.getChannelData(j)[i] = Math.sin(i * (9.8));}
+}
+return buf;
+})(); } catch(e) { }
+try { o6.buffer = o7; } catch(e) { }
+try { o6.connect(o5); } catch(e) { }
+try { o5.connect(o1.destination); } catch(e) { }
+try { o1.listener.speedOfSound = 0.0000019073486328125; } catch(e) { }
+try { o6.loop = true; } catch(e) { }
+try { o8 = (function() {
+var buf = o1.createBuffer(2, 1000, o1.sampleRate);
+for(var j=0; j<2; ++j) {
+for(var i=0; i<1000; ++i) { buf.getChannelData(j)[i] = Math.sin(i * (1));}
+}
+return buf;
+})(); } catch(e) { }
+try { o6.buffer = o7; } catch(e) { }
+try { o6.connect(o5); } catch(e) { }
+try { o5.connect(o1.destination); } catch(e) { }
+try { o6.loopEnd = 1.4901161193847656e-8; } catch(e) { }
+try { o6.connect(o1.destination); } catch(e) { }
+try { o6.buffer = o8; } catch(e) { }
+try { o5.setPosition(0.36, o1.destination.context.destination.channelCountMode, o1.destination.context.destination.channelInterpretation) } catch(e) { }
+try { o2.channelCountMode = 'explicit'; } catch(e) { }
+try { o1.listener.speedOfSound = 4; } catch(e) { }
+try { o1.startRendering(); } catch(e) { }
+</script>
diff --git a/dom/media/test/crashtests/877820.html b/dom/media/test/crashtests/877820.html
new file mode 100644
index 0000000000..6d65c1e9d9
--- /dev/null
+++ b/dom/media/test/crashtests/877820.html
@@ -0,0 +1,4 @@
+<script>
+o1 = new window.OfflineAudioContext(2, 5, 0.39);
+window.location.reload();
+</script>
\ No newline at end of file
diff --git a/dom/media/test/crashtests/878014.html b/dom/media/test/crashtests/878014.html
new file mode 100644
index 0000000000..4a0ca6dce2
--- /dev/null
+++ b/dom/media/test/crashtests/878014.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+try { o2 = new window.AudioContext(1, 15, 44100); } catch(e) { }
+try { o5 = o2.createDelay(0.1); } catch(e) { }
+try { o6 = o2.createPanner(); } catch(e) { }
+try { o8 = o2.createBufferSource(); } catch(e) { }
+try { o9 = (function() {
+var buf = o2.createBuffer(1, 12134, o2.sampleRate);
+for(var j=0; j<1; ++j) {
+for(var i=0; i<12134; ++i) { buf.getChannelData(j)[i] = Math.sin(i * (-127));}
+}
+return buf;
+})(); } catch(e) { }
+try { o8.buffer = o9; } catch(e) { }
+try { o8.connect(o6); } catch(e) { }
+try { o6.connect(o5, 0, 0) } catch(e) { }
+try { o8.buffer = (function() {
+var buf = o2.createBuffer(1, 5409, o2.sampleRate);
+for(var j=0; j<1; ++j) {
+for(var i=0; i<5409; ++i) { buf.getChannelData(j)[i] = Math.sin(i * (-1));}
+}
+return buf;
+})(); } catch(e) { }
+setTimeout(function() { try { o5.delayTime.setValueAtTime(0.78, 121560862.56366833); } catch(e) { } setTimeout(done, 0); },128)
+try { o5.delayTime.value = 0.4283; } catch(e) { }
+
+function done() {
+  document.documentElement.removeAttribute("class");
+}
+</script>
diff --git a/dom/media/test/crashtests/878328.html b/dom/media/test/crashtests/878328.html
new file mode 100644
index 0000000000..ec7b39871b
--- /dev/null
+++ b/dom/media/test/crashtests/878328.html
@@ -0,0 +1,5 @@
+<script>
+o1 = new window.AudioContext(2, 7, 44100);
+o5 = o1.createDelay(1);
+o5.delayTime.setValueCurveAtTime(new Float32Array(3), 1.7976931348623157e+308, 0.64);
+</script>
\ No newline at end of file
diff --git a/dom/media/test/crashtests/878407.html b/dom/media/test/crashtests/878407.html
new file mode 100644
index 0000000000..ae2918dc85
--- /dev/null
+++ b/dom/media/test/crashtests/878407.html
@@ -0,0 +1,11 @@
+<script>
+o1 = new window.AudioContext();
+o4 = o1.createDelay(0.4468);
+o6 = o1.createPanner();
+o7 = (function() {var buf = o1.createBuffer(1, 1000, o1.sampleRate);for(var j=0; j<1; ++j) {for(var i=0; i<1000; ++i) {buf.getChannelData(j)[i] = Math.sin(i * (-15));}}return buf;})();
+o8 = o1.createBufferSource();
+o8.buffer = o7;
+o8.connect(o6);
+o6.connect(o4)
+o4.delayTime.setValueAtTime(0.6019893103749466289898, 0.26)
+</script>
diff --git a/dom/media/test/crashtests/878478.html b/dom/media/test/crashtests/878478.html
new file mode 100644
index 0000000000..89a47ddb55
--- /dev/null
+++ b/dom/media/test/crashtests/878478.html
@@ -0,0 +1,30 @@
+<script>
+var Context0= new AudioContext()
+var BufferSource0=Context0.createBufferSource();
+
+BufferSource0.loop=true;
+
+BufferSource0.buffer=function(){
+	var channels=3; 
+	var length=97252;
+	var Buffer=Context0.createBuffer(channels,length,Context0.sampleRate);
+	for(var y=0;y<channels;y++){
+		var bufferData= Buffer.getChannelData(y);
+		for (var i = 0; i < length; ++i) { bufferData[i] = 1;}
+	};
+	return Buffer;
+}();
+
+BufferSource0.playbackRate.cancelScheduledValues(0.4);
+
+BufferSource0.loopEnd=5e-324;
+
+BufferSource0.buffer=function(){
+	var length=26590;
+	var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+	var bufferData= Buffer.getChannelData(0);
+	for (var i = 0; i < length; ++i) { bufferData[i] = 1};
+	return Buffer;
+}();
+
+</script>
diff --git a/dom/media/test/crashtests/880129.html b/dom/media/test/crashtests/880129.html
new file mode 100644
index 0000000000..775e9d80ba
--- /dev/null
+++ b/dom/media/test/crashtests/880129.html
@@ -0,0 +1,9 @@
+<script>
+try { o1 = new window.AudioContext(3, 2, 44100); } catch(e) { }
+try { o6 = o1.createBufferSource(); } catch(e) { }
+try { o15 = o1.createAnalyser(); } catch(e) { }
+try { o15.fftSize = 32; } catch(e) { }
+try { o6.connect(o15,0,0) } catch(e) { }
+try { o27 = o1.createPanner(); } catch(e) { }
+try { o6.buffer = function(){var buffer = o1.createBuffer(2, 1148, o1.sampleRate);for(var c=0; c<2; c++) {for(var i=0; i<1148; i++) {buffer.getChannelData(c)[i] = 0;}}return buffer;}() } catch(e) { }
+</script>
\ No newline at end of file
diff --git a/dom/media/test/crashtests/880202.html b/dom/media/test/crashtests/880202.html
new file mode 100644
index 0000000000..dc0fade9db
--- /dev/null
+++ b/dom/media/test/crashtests/880202.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var Context0= new window.OfflineAudioContext(15,12119,44100)
+var BufferSource1=Context0.createBufferSource();
+var Gain0=Context0.createGain();
+var Panner0=Context0.createPanner();
+Context0.listener.setPosition(29,135,158);
+
+BufferSource1.connect(Gain0);
+
+BufferSource1.buffer=function(){
+	var channels=3; 
+	var length=53325;
+	var Buffer=Context0.createBuffer(channels,length,Context0.sampleRate);
+	for(var y=0;y<channels;y++){
+		var bufferData= Buffer.getChannelData(y);
+		for (var i = 0; i < length; ++i) { 
+			bufferData[i] = i*(270);
+		}
+	};
+	return Buffer;
+}();
+
+Gain0.connect(Panner0);
+Panner0.panningModel="equalpower";
+
+
+setTimeout(function(){
+document.documentElement.removeAttribute("class");
+},500)
+
+</script>
diff --git a/dom/media/test/crashtests/880342-1.html b/dom/media/test/crashtests/880342-1.html
new file mode 100644
index 0000000000..7d1aa0c3e3
--- /dev/null
+++ b/dom/media/test/crashtests/880342-1.html
@@ -0,0 +1,208 @@
+<script>
+try { o1 = new window.AudioContext(2, 10, 1019159); } catch(e) { }
+try { o2 = o1.createBufferSource(); } catch(e) { }
+try { o3 = o1.createConvolver(); } catch(e) { }
+try { o4 = o1.createChannelMerger(2); } catch(e) { }
+try { o5 = o1.createAnalyser(); } catch(e) { }
+try { o6 = o1.createPanner(); } catch(e) { }
+try { o7 = o1.createDynamicsCompressor(); } catch(e) { }
+try { o8 = o1.createWaveShaper(); } catch(e) { }
+try { o9 = o1.createChannelSplitter(6); } catch(e) { }
+try { o10 = o1.createScriptProcessor(8192, 2, 3); } catch(e) { }
+try { o1.listener.setPosition(-144115188075855870, 0, -5e-324) } catch(e) { }
+try { o3.buffer = function(){var buffer = o1.createBuffer(2, 741, o1.sampleRate);for(var c=0; c<2; c++) {for(var i=0; i<741; i++) {buffer.getChannelData(c)[i] = 1;}}return buffer;}(); } catch(e) { }
+try { o10.onaudioprocess = function(e) { /* onEvent */ }; } catch(e) { }
+try { o3.connect(o5,0,0) } catch(e) { }
+try { o9.channelCountMode = 'max'; } catch(e) { }
+try { o10.onaudioprocess = function(e) { /* onEvent */ }; } catch(e) { }
+try { o7.channelInterpretation = 'speakers'; } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(2, 1887, 63346);for(var c=0; c<2; c++) {for(var i=0; i<1887; i++) {buffer.getChannelData(c)[i] = 1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o2.playbackRate.exponentialRampToValueAtTime(3.819464020334534, 32) } catch(e) { }
+try { o5.connect(o9,2,0) } catch(e) { }
+try { o9.channelCountMode = 'explicit'; } catch(e) { }
+try { o1.listener.speedOfSound = 72057594037927940; } catch(e) { }
+try { o1.destination.channelCountMode = 'explicit'; } catch(e) { }
+try { o7.threshold.value = 0.0646435404346891590021684237399313133209944; } catch(e) { }
+try { o7.connect(o10,0,0) } catch(e) { }
+try { o1.destination.channelInterpretation = 'speakers'; } catch(e) { }
+try { o3.connect(o4,0,0) } catch(e) { }
+try { o7.release.value = 23.030355486273447; } catch(e) { }
+try { o9.connect(o9,4,0) } catch(e) { }
+try { o6.channelCountMode = 'max'; } catch(e) { }
+try { o7.threshold.value = 0.6395867363641939418172910336579661816358566284179687500; } catch(e) { }
+try { o2.connect(o9,3,0) } catch(e) { }
+try { o10.onaudioprocess = function(e) { /* onEvent */ }; } catch(e) { }
+try { o7.connect(o10,0,0) } catch(e) { }
+try { o5.connect(o5,0,0) } catch(e) { }
+try { o2.playbackRate.value = 5e-324; } catch(e) { }
+try { o4.channelInterpretation = 'discrete'; } catch(e) { }
+try { o2.playbackRate.value = 1.2211628339508704; } catch(e) { }
+try { o2.channelCountMode = 'clamped-max'; } catch(e) { }
+try { o1.listener.dopplerFactor = 32; } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(22, 1811, 21177);for(var c=0; c<22; c++) {for(var i=0; i<1811; i++) {buffer.getChannelData(c)[i] = 1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o5.channelCountMode = 'max'; } catch(e) { }
+try { o1.listener.speedOfSound = 1024; } catch(e) { }
+try { o2.playbackRate.value = 9.999999999999998e-91; } catch(e) { }
+try { o1.listener.speedOfSound = 16; } catch(e) { }
+try { o8.curve = new Float32Array(256); } catch(e) { }
+try { o1.listener.setVelocity(0, 128, 4) } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(23, 483, o1.sampleRate);for(var c=0; c<23; c++) {for(var i=0; i<483; i++) {buffer.getChannelData(c)[i] = 0.026;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(3, 945, 43803);for(var c=0; c<3; c++) {for(var i=0; i<945; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(19, 997, 23781);for(var c=0; c<19; c++) {for(var i=0; i<997; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o1.listener.speedOfSound = -8; } catch(e) { }
+try { o3.channelCountMode = 'explicit'; } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(3, 1740, o1.sampleRate);for(var c=0; c<3; c++) {for(var i=0; i<1740; i++) {buffer.getChannelData(c)[i] = 8;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(1, 1057, 30602);for(var c=0; c<1; c++) {for(var i=0; i<1057; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(3, 78, o1.sampleRate);for(var c=0; c<3; c++) {for(var i=0; i<78; i++) {buffer.getChannelData(c)[i] = 10;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o1.listener.setPosition(9.999999999999995e-275, 0.0001, 2) } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(1, 863, o1.sampleRate);for(var c=0; c<1; c++) {for(var i=0; i<863; i++) {buffer.getChannelData(c)[i] = 1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o8.channelCount = 3; } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(2, 1821, o1.sampleRate);for(var c=0; c<2; c++) {for(var i=0; i<1821; i++) {buffer.getChannelData(c)[i] = 0.3655;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o6.connect(o6,0,0) } catch(e) { }
+try { o1.listener.setOrientation(128, -0.479527496, 128, 1, 1, -16) } catch(e) { }
+try { o4.connect(o8,0,0) } catch(e) { }
+try { o7.reduction.exponentialRampToValueAtTime(1.7976931348623157e+308, 2048) } catch(e) { }
+try { o1.listener.dopplerFactor = 0.5754; } catch(e) { }
+try { o7.release.value = 0; } catch(e) { }
+try { o5.getFloatFrequencyData(new Float32Array(2048)) } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(2, 120, 42419);for(var c=0; c<2; c++) {for(var i=0; i<120; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o3.buffer = function(){var buffer = o1.createBuffer(1, 1620, o1.sampleRate);for(var c=0; c<1; c++) {for(var i=0; i<1620; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}(); } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(1, 823, 77239);for(var c=0; c<1; c++) {for(var i=0; i<823; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o1.destination.channelInterpretation = 'speakers'; } catch(e) { }
+try { o1.listener.setPosition(2048, 0.000522899209, -4503599627370495) } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(3, 84028, 75483);for(var c=0; c<3; c++) {for(var i=0; i<84028; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o2.playbackRate.setTargetAtTime(5e-324, 9.999999999999998e-104, 0) } catch(e) { }
+try { o7.attack.value = 9.999999999999994e-236; } catch(e) { }
+try { o1.listener.dopplerFactor = 1024; } catch(e) { }
+try { o3.connect(o7,0,0) } catch(e) { }
+try { o2.playbackRate.linearRampToValueAtTime(0, 0) } catch(e) { }
+try { o4.connect(o10,0,0) } catch(e) { }
+try { o1.listener.setVelocity(0.682, 32, 1e-76) } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(3, 201, o1.sampleRate);for(var c=0; c<3; c++) {for(var i=0; i<201; i++) {buffer.getChannelData(c)[i] = 4;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o2.connect(o6,0,0) } catch(e) { }
+try { o5.getByteFrequencyData(new Uint8Array(32)) } catch(e) { }
+try { o3.connect(o6,0,0) } catch(e) { }
+try { o7.channelCount = 1; } catch(e) { }
+try { o2.playbackRate.setValueCurveAtTime(new Float32Array(512), 8, 1) } catch(e) { }
+try { o3.connect(o4,0,1) } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(3, 1996, o1.sampleRate);for(var c=0; c<3; c++) {for(var i=0; i<1996; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o1.listener.dopplerFactor = 2; } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(2, 983, 60517);for(var c=0; c<2; c++) {for(var i=0; i<983; i++) {buffer.getChannelData(c)[i] = 1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o6.coneInnerAngle = 360; } catch(e) { }
+try { o8.curve = new Float32Array(512); } catch(e) { }
+try { o1.listener.setPosition(32, 16, 9.999999999999995e-280) } catch(e) { }
+try { o6.connect(o6,0,0) } catch(e) { }
+try { o1.listener.setPosition(2097151, 512, 5e-324) } catch(e) { }
+try { o7.channelCountMode = 'clamped-max'; } catch(e) { }
+try { o1.destination.channelCountMode = 'max'; } catch(e) { }
+try { o1.listener.setPosition(0, 1000000, 64) } catch(e) { }
+try { o4.connect(o5,0,0) } catch(e) { }
+try { o9.connect(o4,0,1) } catch(e) { }
+try { o7.attack.setValueCurveAtTime(new Float32Array(8), 256, 2048) } catch(e) { }
+try { o9.channelCountMode = 'explicit'; } catch(e) { }
+try { o1.listener.dopplerFactor = 5e-324; } catch(e) { }
+try { o4.connect(o10,0,0) } catch(e) { }
+try { o7.ratio.cancelScheduledValues(1) } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(1, 1590, 9733);for(var c=0; c<1; c++) {for(var i=0; i<1590; i++) {buffer.getChannelData(c)[i] = 2;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o1.destination.channelCount = 2; } catch(e) { }
+try { o1.destination.channelInterpretation = 'speakers'; } catch(e) { }
+try { o5.channelCountMode = 'max'; } catch(e) { }
+try { o9.channelCountMode = 'clamped-max'; } catch(e) { }
+try { o7.attack.setTargetAtTime(0.11499421161482907549622467513472656719386577606201171875000, 1, 1.7976931348623157e+308) } catch(e) { }
+try { o2.playbackRate.value = 1; } catch(e) { }
+try { o3.normalize = false; } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(2, 1866, o1.sampleRate);for(var c=0; c<2; c++) {for(var i=0; i<1866; i++) {buffer.getChannelData(c)[i] = 0.174908422905697580329587026426452212035655975341797;}}return buffer;}(); } catch(e) { }
+try { o2.playbackRate.value = 1.0; } catch(e) { }
+try { o7.threshold.value = 100; } catch(e) { }
+try { o1.listener.setVelocity(961.4441892370145, 9.999999999999999e-157, 1) } catch(e) { }
+try { o5.getByteFrequencyData(new Uint8Array(2)) } catch(e) { }
+try { o6.connect(o10,0,0) } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(3, 1176, o1.sampleRate);for(var c=0; c<3; c++) {for(var i=0; i<1176; i++) {buffer.getChannelData(c)[i] = 9.753993292300242;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o2.playbackRate.linearRampToValueAtTime(0.8687, 32) } catch(e) { }
+try { o5.channelCountMode = 'explicit'; } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(13, 703, 12723);for(var c=0; c<13; c++) {for(var i=0; i<703; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o2.loopEnd = 1.7976931348623157e+308; } catch(e) { }
+try { o3.connect(o7,0,0) } catch(e) { }
+try { o1.destination.channelCountMode = 'clamped-max'; } catch(e) { }
+try { o1.destination.channelInterpretation = 'discrete'; } catch(e) { }
+try { o2.connect(o10,0,0) } catch(e) { }
+try { o3.normalize = false; } catch(e) { }
+try { /* switch-case did not return anything. */ } catch(e) { }
+try { o10.connect(o8,0,0) } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(3, 132, 88507);for(var c=0; c<3; c++) {for(var i=0; i<132; i++) {buffer.getChannelData(c)[i] = 1.7976931348623157e+308;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o2.loopStart = 1.7976931348623157e+308; } catch(e) { }
+try { o1.listener.dopplerFactor = 1024; } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(1, 40, o1.sampleRate);for(var c=0; c<1; c++) {for(var i=0; i<40; i++) {buffer.getChannelData(c)[i] = 1.3785770335346594;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o4.connect(o9,5,0) } catch(e) { }
+try { o8.curve = new Float32Array(16); } catch(e) { }
+try { o10.onaudioprocess = function(e) { /* onEvent */ }; } catch(e) { }
+try { o6.channelCountMode = 'explicit'; } catch(e) { }
+try { o2.playbackRate.value = 0; } catch(e) { }
+try { o4.channelCount = 3; } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(3, 220, o1.sampleRate);for(var c=0; c<3; c++) {for(var i=0; i<220; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o1.destination.channelInterpretation = 'discrete'; } catch(e) { }
+try { o1.listener.setPosition(70368744177664, 2048, 1.7976931348623157e+308) } catch(e) { }
+try { o2.playbackRate.setValueCurveAtTime(new Float32Array(128), 1.7976931348623157e+308, 0.75) } catch(e) { }
+try { o5.fftSize = 118; } catch(e) { }
+try { o5.minDecibels = 1; } catch(e) { }
+try { o7.release.value = 5e-324; } catch(e) { }
+try { o2.channelCount = 3; } catch(e) { }
+try { o2.channelCountMode = 'clamped-max'; } catch(e) { }
+try { o3.normalize = false; } catch(e) { }
+try { o1.listener.speedOfSound = 2; } catch(e) { }
+try { o2.loopStart = 32; } catch(e) { }
+try { o3.channelCountMode = 'max'; } catch(e) { }
+try { o1.listener.setPosition(0.37976588317653304, -274877906943, 64) } catch(e) { }
+try { o8.curve = new Float32Array(4); } catch(e) { }
+try { o1.listener.setVelocity(16, -1024, 0) } catch(e) { }
+try { o5.minDecibels = 10000; } catch(e) { }
+try { o2.playbackRate.value = 5e-324; } catch(e) { }
+try { o3.connect(o9,1,0) } catch(e) { }
+try { o10.onaudioprocess = function(e) { /* onEvent */ }; } catch(e) { }
+try { o5.connect(o8,0,0) } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(3, 554, o1.sampleRate);for(var c=0; c<3; c++) {for(var i=0; i<554; i++) {buffer.getChannelData(c)[i] = 0.000001;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o7.release.value = 0; } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(1, 1289, 29583);for(var c=0; c<1; c++) {for(var i=0; i<1289; i++) {buffer.getChannelData(c)[i] = 5e-324;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o1.listener.setOrientation(1024, 64, 16, 1024, 1, 68719476735) } catch(e) { }
+try { o1.listener.setOrientation(512, 10000000, 274877906944, 9.999999999999998e-113, -8, 3.6191134923595274) } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(1, 1453, 15258);for(var c=0; c<1; c++) {for(var i=0; i<1453; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o8.channelInterpretation = 'discrete'; } catch(e) { }
+try { o5.channelInterpretation = 'discrete'; } catch(e) { }
+try { o7.connect(o9,4,0) } catch(e) { }
+try { o8.connect(o10,0,0) } catch(e) { }
+try { o1.listener.setPosition(18014398509481984, 16, 0.505129302503804056279079759406158700585365295410156250000) } catch(e) { }
+try { o10.connect(o9,5,0) } catch(e) { }
+try { o2.loop = false; } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(11, 1673, o1.sampleRate);for(var c=0; c<11; c++) {for(var i=0; i<1673; i++) {buffer.getChannelData(c)[i] = 0;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(2, 577, o1.sampleRate);for(var c=0; c<2; c++) {for(var i=0; i<577; i++) {buffer.getChannelData(c)[i] = 0.5611;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o1.listener.setOrientation(64, 2049, 5e-324, 0.1777, 2, 7) } catch(e) { }
+try { o5.maxDecibels = 128; } catch(e) { }
+try { o2.start(0) } catch(e) { }
+</script>
\ No newline at end of file
diff --git a/dom/media/test/crashtests/880342-2.html b/dom/media/test/crashtests/880342-2.html
new file mode 100644
index 0000000000..a8ef88ae70
--- /dev/null
+++ b/dom/media/test/crashtests/880342-2.html
@@ -0,0 +1,8 @@
+<script>
+try { o1 = new window.AudioContext(2, 10, 1019159); } catch(e) { }
+try { o2 = o1.createBufferSource(); } catch(e) { }
+try { o3 = o1.createConvolver(); } catch(e) { }
+try { o3.buffer = function(){var buffer = o1.createBuffer(2, 741, o1.sampleRate);for(var c=0; c<2; c++) {for(var i=0; i<741; i++) {buffer.getChannelData(c)[i] = 1;}}return buffer;}(); } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(2, 120, 42419);for(var c=0; c<2; c++) {for(var i=0; i<120; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}() } catch(e) { }
+try { o3.buffer = function(){var buffer = o1.createBuffer(1, 1620, o1.sampleRate);for(var c=0; c<1; c++) {for(var i=0; i<1620; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}(); } catch(e) { }
+</script>
\ No newline at end of file
diff --git a/dom/media/test/crashtests/880384.html b/dom/media/test/crashtests/880384.html
new file mode 100644
index 0000000000..798fbf133d
--- /dev/null
+++ b/dom/media/test/crashtests/880384.html
@@ -0,0 +1,8 @@
+<script>
+o1 = new window.AudioContext(3, 256, 44100);
+o2 = o1.createBufferSource();
+o3 = o1.createConvolver();
+o3.normalize = false;
+o3.buffer = function(){var buffer = o1.createBuffer(2, 1051, o1.sampleRate);for(var c=0; c<2; c++) {for(var i=0; i<1051; i++) {buffer.getChannelData(c)[i] = 1;}}return buffer;}();
+o3.buffer = function(){var buffer = o1.createBuffer(2, 1112, o1.sampleRate);for(var c=0; c<2; c++) {for(var i=0; i<1112; i++) {buffer.getChannelData(c)[i] = 1;}}return buffer;}();
+</script>
diff --git a/dom/media/test/crashtests/880404.html b/dom/media/test/crashtests/880404.html
new file mode 100644
index 0000000000..bf34932388
--- /dev/null
+++ b/dom/media/test/crashtests/880404.html
@@ -0,0 +1,6 @@
+<script>
+o1 = new window.OfflineAudioContext(2, 32, 44100);
+o12 = o1.createConvolver();
+o12.buffer = function(){var buffer = o1.createBuffer(1, 78, o1.sampleRate);for(var c=0; c<1; c++) {for(var i=0; i<78; i++) {buffer.getChannelData(c)[i] = 1;}}return buffer;}();
+o1.startRendering();
+</script>
\ No newline at end of file
diff --git a/dom/media/test/crashtests/880724.html b/dom/media/test/crashtests/880724.html
new file mode 100644
index 0000000000..b57b5f9964
--- /dev/null
+++ b/dom/media/test/crashtests/880724.html
@@ -0,0 +1,13 @@
+<script>
+o1 = new window.AudioContext();
+o5 = o1.createConvolver();
+o5.buffer = function() {
+    var buffer = o1.createBuffer(2, 3, 33120);
+    for(var c=0; c<2; c++) {
+        for(var i=0; i<3; i++) {
+            buffer.getChannelData(c)[i] = -1;
+        }
+    }
+    return buffer;
+}();
+</script>
\ No newline at end of file
diff --git a/dom/media/test/crashtests/881775.html b/dom/media/test/crashtests/881775.html
new file mode 100644
index 0000000000..d55c45d17e
--- /dev/null
+++ b/dom/media/test/crashtests/881775.html
@@ -0,0 +1,25 @@
+<script>
+o1 = new window.AudioContext(2, 16, 44100);
+o2 = o1.createBufferSource();
+o12 = o1.createBiquadFilter();
+o1.destination.channelCountMode = 'max';
+o2.buffer = function(){
+    var buffer = o1.createBuffer(2, 326, 77632);
+    for(var c=0; c<2; c++) {
+        for(var i=0; i<326; i++) {
+            buffer.getChannelData(c)[i] = -1;
+        }
+    }
+    return buffer;
+}();
+o2.connect(o1.destination);
+o2.buffer = function(){
+    var buffer = o1.createBuffer(3, 405, o1.sampleRate);
+    for(var c=0; c<3; c++) {
+        for(var i=0; i<405; i++) {
+            buffer.getChannelData(c)[i] = 1;
+        }
+    }
+    return buffer;
+}();
+</script>
diff --git a/dom/media/test/crashtests/882956.html b/dom/media/test/crashtests/882956.html
new file mode 100644
index 0000000000..ae7b441f99
--- /dev/null
+++ b/dom/media/test/crashtests/882956.html
@@ -0,0 +1,15 @@
+<script>
+o1 = new window.AudioContext(1, 2048, 44100);
+o2 = o1.createBufferSource();
+o1.destination.channelCountMode = 'max';
+o2.connect(o1.destination);
+o2.buffer = function(){
+    var buffer = o1.createBuffer(30, 442, 94933);
+    for(var c=0; c<30; c++) {
+        for(var i=0; i<442; i++) {
+            buffer.getChannelData(c)[i] = 1;
+        }
+    }
+    return buffer;
+}();
+</script>
diff --git a/dom/media/test/crashtests/884459.html b/dom/media/test/crashtests/884459.html
new file mode 100644
index 0000000000..e321d569f2
--- /dev/null
+++ b/dom/media/test/crashtests/884459.html
@@ -0,0 +1,12 @@
+<script>
+var Context0= new window.OfflineAudioContext(14,191531,44100)
+var BufferSource1=Context0.createBufferSource();
+
+setInterval(function(){
+BufferSource1.playbackRate.setTargetAtTime(0xC8F461D3EE6B2,(Context0.currentTime+0.0677539280615747),0.826130285160616);
+BufferSource1.playbackRate.setValueAtTime(35467.63924283907536607336193,0);
+},1)
+
+Context0.startRendering();
+
+</script>
diff --git a/dom/media/test/crashtests/889042.html b/dom/media/test/crashtests/889042.html
new file mode 100644
index 0000000000..9f74979c58
--- /dev/null
+++ b/dom/media/test/crashtests/889042.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+  (new AudioContext()).createConvolver().buffer = null;
+</script>
diff --git a/dom/media/test/crashtests/907986-1.html b/dom/media/test/crashtests/907986-1.html
new file mode 100644
index 0000000000..4dec6bc480
--- /dev/null
+++ b/dom/media/test/crashtests/907986-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var context = new window.OfflineAudioContext(1, 100, 48000);
+context.oncomplete = function(e) {
+    document.documentElement.removeAttribute("class");
+};
+// zero front vector
+context.listener.setOrientation(0, 0, 0, 6.311749985202524e+307, 0, 0);
+var panner = context.createPanner();
+panner.setPosition(3.40282e+38, 4, 3.40282e+38);
+panner.connect(context.destination);
+var source = context.createOscillator();
+source.connect(panner);
+source.start(0);
+context.startRendering();
+</script>
diff --git a/dom/media/test/crashtests/907986-2.html b/dom/media/test/crashtests/907986-2.html
new file mode 100644
index 0000000000..e0626ba2c2
--- /dev/null
+++ b/dom/media/test/crashtests/907986-2.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var context = new window.OfflineAudioContext(1, 100, 48000);
+context.oncomplete = function(e) {
+    document.documentElement.removeAttribute("class");
+};
+// zero up vector
+context.listener.setOrientation(0, 6.311749985202524e+307, 0, 0, 0, 0);
+var panner = context.createPanner();
+panner.setPosition(1, 2, 3);
+panner.connect(context.destination);
+var source = context.createOscillator();
+source.connect(panner);
+source.start(0);
+context.startRendering();
+</script>
diff --git a/dom/media/test/crashtests/907986-3.html b/dom/media/test/crashtests/907986-3.html
new file mode 100644
index 0000000000..75b756c363
--- /dev/null
+++ b/dom/media/test/crashtests/907986-3.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var context = new window.OfflineAudioContext(1, 100, 48000);
+context.oncomplete = function(e) {
+    document.documentElement.removeAttribute("class");
+};
+// linearly dependent
+context.listener.setOrientation(0, 0, -6.311749985202524e+307, 0, 0, 6.311749985202524e+307);
+var panner = context.createPanner();
+panner.setPosition(1, 2, 3);
+panner.connect(context.destination);
+var source = context.createOscillator();
+source.connect(panner);
+source.start(0);
+context.startRendering();
+</script>
diff --git a/dom/media/test/crashtests/907986-4.html b/dom/media/test/crashtests/907986-4.html
new file mode 100644
index 0000000000..a73500efca
--- /dev/null
+++ b/dom/media/test/crashtests/907986-4.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var context = new window.OfflineAudioContext(1, 100, 48000);
+context.oncomplete = function(e) {
+    document.documentElement.removeAttribute("class");
+};
+var panner = context.createPanner();
+panner.setPosition(0, 3, 0);  // directly overhead
+panner.connect(context.destination);
+var source = context.createOscillator();
+source.connect(panner);
+source.start(0);
+context.startRendering();
+</script>
diff --git a/dom/media/test/crashtests/910171-1.html b/dom/media/test/crashtests/910171-1.html
new file mode 100644
index 0000000000..9f3ec831be
--- /dev/null
+++ b/dom/media/test/crashtests/910171-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var context = new window.OfflineAudioContext(1, 4096, 48000);
+context.oncomplete = function(e) {
+    document.documentElement.removeAttribute("class");
+};
+var delay = context.createDelay();
+delay.connect(context.destination);
+delay.delayTime.value = 1.0;
+var buffer = context.createBuffer(1, 2048, context.sampleRate);
+var source = context.createBufferSource();
+source.buffer = buffer;
+source.connect(delay);
+source.start();
+context.startRendering();
+</script>
diff --git a/dom/media/test/crashtests/920987.html b/dom/media/test/crashtests/920987.html
new file mode 100644
index 0000000000..6e8b2992a6
--- /dev/null
+++ b/dom/media/test/crashtests/920987.html
@@ -0,0 +1,6 @@
+<script>
+var ctx = new AudioContext();
+var buffer = ctx.createBuffer(1, 1000, ctx.sampleRate);
+var array = new Float32Array(900);
+buffer.copyToChannel(array, 0, 0xfffffff8);
+</script>
diff --git a/dom/media/test/crashtests/925619-1.html b/dom/media/test/crashtests/925619-1.html
new file mode 100644
index 0000000000..146c531f9b
--- /dev/null
+++ b/dom/media/test/crashtests/925619-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+// 1024 > 89478.5 * 48000 - (1 << 32)
+var context = new window.OfflineAudioContext(1, 1024, 48000);
+context.oncomplete = function(e) {
+    document.documentElement.removeAttribute("class");
+};
+var buffer = context.createBuffer(1, 2048, context.sampleRate);
+var source = context.createBufferSource();
+source.buffer = buffer;
+source.start(89478.5); // 89478.5 is a little greater than 2^32 / 48000.
+context.startRendering();
+</script>
diff --git a/dom/media/test/crashtests/925619-2.html b/dom/media/test/crashtests/925619-2.html
new file mode 100644
index 0000000000..e734b8bcad
--- /dev/null
+++ b/dom/media/test/crashtests/925619-2.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var context = new window.OfflineAudioContext(1, 2048, 48000);
+// 1024 > 89478.5 * 48000 - (1 << 32)
+var buffer = context.createBuffer(1, 1024, context.sampleRate);
+var source = context.createBufferSource();
+source.buffer = buffer;
+source.onended = function(e) {
+  document.documentElement.removeAttribute("class");
+};
+source.start(0);
+source.stop(89478.5); // 89478.5 is a little greater than 2^32 / 48000.
+context.startRendering();
+</script>
diff --git a/dom/media/test/crashtests/926619.html b/dom/media/test/crashtests/926619.html
new file mode 100644
index 0000000000..2ead02af4e
--- /dev/null
+++ b/dom/media/test/crashtests/926619.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+  var ac = new window.AudioContext();
+
+  var _ChannelMergerNode = ac.createChannelMerger(4);
+
+  var _MediaStreamAudioDestinationNode = ac.createMediaStreamDestination();
+  var _MediaStream = _MediaStreamAudioDestinationNode.stream;
+  var _MediaStreamAudioSourceNode = ac.createMediaStreamSource(_MediaStream);
+
+  _ChannelMergerNode.connect(_MediaStreamAudioDestinationNode, 0, 0);
+  _MediaStreamAudioSourceNode.connect(_ChannelMergerNode, 0, 0);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/media/test/crashtests/933151.html b/dom/media/test/crashtests/933151.html
new file mode 100644
index 0000000000..3d45f7af38
--- /dev/null
+++ b/dom/media/test/crashtests/933151.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var ac = new window.AudioContext();
+  var buffer = ac.createBuffer(1, 24313, 47250);
+  buffer.copyFromChannel(buffer.getChannelData(0), '');
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/media/test/crashtests/933156.html b/dom/media/test/crashtests/933156.html
new file mode 100644
index 0000000000..b89445a43d
--- /dev/null
+++ b/dom/media/test/crashtests/933156.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+function boom()
+{
+  var ac = new window.AudioContext();
+
+  var panner = ac.createPanner();
+  panner.setPosition(8, 0.7643051305237005, 0.10292575673733972);
+
+  var oscillator = ac.createOscillator();
+  oscillator.connect(panner);
+  oscillator.start(0);
+
+  setTimeout(function() {
+    panner.panningModel = 'equalpower';
+    oscillator.stop(0);
+    document.documentElement.removeAttribute("class");
+  }, 0.5);
+}
+boom();
+</script>
+</html>
diff --git a/dom/media/test/crashtests/944851.html b/dom/media/test/crashtests/944851.html
new file mode 100644
index 0000000000..4f663accc4
--- /dev/null
+++ b/dom/media/test/crashtests/944851.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+var ac = new AudioContext(1, 1354, 44100);
+var shaper = ac.createWaveShaper();
+var biquad = ac.createBiquadFilter();
+shaper.connect(biquad.frequency);
+biquad.getFrequencyResponse(new Float32Array(55785),
+                            new Float32Array(62876),
+                            new Float32Array(45111));
+
+</script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/952756.html b/dom/media/test/crashtests/952756.html
new file mode 100644
index 0000000000..ffced2e400
--- /dev/null
+++ b/dom/media/test/crashtests/952756.html
@@ -0,0 +1,19 @@
+<script>
+var Context0= new AudioContext()
+var BufferSource0=Context0.createBufferSource();
+BufferSource0.buffer=function(){
+	var length=35887;
+	var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+	var bufferData= Buffer.getChannelData(0);
+	for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(0.39765272522345185))};
+	return Buffer;
+}();
+BufferSource0.start(0.01932738965842873,0.33345631847623736,0.3893404237460345);
+BufferSource0.buffer=function(){
+	var length=15952;
+	var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+	var bufferData= Buffer.getChannelData(0);
+	for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(85))};
+	return Buffer;
+}();
+</script>
diff --git a/dom/media/test/crashtests/986901.html b/dom/media/test/crashtests/986901.html
new file mode 100644
index 0000000000..343df2c0ed
--- /dev/null
+++ b/dom/media/test/crashtests/986901.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+    var ac = new window.AudioContext();
+    var delay1 = ac.createDelay(0.02);
+    var delay2 = ac.createDelay(0.002);
+    var source = ac.createOscillator();
+    source.start(0);
+    source.connect(delay1, 0, 0);
+    delay2.connect(delay1, 0, 0);
+    delay1.connect(delay2, 0, 0);
+</script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/990794.html b/dom/media/test/crashtests/990794.html
new file mode 100644
index 0000000000..8b40088b1a
--- /dev/null
+++ b/dom/media/test/crashtests/990794.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<script>
+var ctx = new AudioContext();
+var source = ctx.createOscillator();
+source.start(0);
+
+function appendMerger(src) {
+  const inputCount = 18;
+
+  var merger = ctx.createChannelMerger(32);
+
+  for (var i = 0; i < inputCount; ++i) {
+    src.connect(merger, 0, i);
+  }
+
+  return merger;
+}
+
+for (var i = 0; i < 6; ++i) {
+  source = appendMerger(source);
+}
+</script>
diff --git a/dom/media/test/crashtests/995289.html b/dom/media/test/crashtests/995289.html
new file mode 100644
index 0000000000..c988f41fa8
--- /dev/null
+++ b/dom/media/test/crashtests/995289.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<script>
+var r0=new AudioContext();
+var r5=r0.createOscillator();
+var r6=r0.createPeriodicWave(new Float32Array(1),new Float32Array(1));
+r5.frequency.value = 4294967295;
+r5.start(0);
+r5.setPeriodicWave(r6);
+</script>
diff --git a/dom/media/test/crashtests/adts-truncated.aac b/dom/media/test/crashtests/adts-truncated.aac
new file mode 100644
index 0000000000..670f696e1d
Binary files /dev/null and b/dom/media/test/crashtests/adts-truncated.aac differ
diff --git a/dom/media/test/crashtests/adts.aac b/dom/media/test/crashtests/adts.aac
new file mode 100644
index 0000000000..208515464a
Binary files /dev/null and b/dom/media/test/crashtests/adts.aac differ
diff --git a/dom/media/test/crashtests/analyser-channels-1.html b/dom/media/test/crashtests/analyser-channels-1.html
new file mode 100644
index 0000000000..2f3133cf13
--- /dev/null
+++ b/dom/media/test/crashtests/analyser-channels-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+  var context = new window.OfflineAudioContext(1, 256, 48000);
+  var analyser = context.createAnalyser();
+  analyser.channelCount = 2;
+  analyser.channelCountMode = "explicit";
+  analyser.fftSize = 32;
+  var source = context.createOscillator();
+  source.connect(analyser);
+  source.start(0);
+  context.startRendering().
+    then(function() {
+      document.documentElement.removeAttribute("class");
+    });
+</script>
diff --git a/dom/media/test/crashtests/audiocontext-after-unload-1.html b/dom/media/test/crashtests/audiocontext-after-unload-1.html
new file mode 100644
index 0000000000..9b4f1181d2
--- /dev/null
+++ b/dom/media/test/crashtests/audiocontext-after-unload-1.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<title>Test for bug 1646601</title>
+<script>
+document.addEventListener('DOMContentLoaded', async () => {
+  const frame = document.createElement('iframe');
+  document.body.appendChild(frame);
+  frame.srcdoc = '<html></html>';
+  await new Promise(resolve => frame.onload = resolve);
+  const subwin = frame.contentWindow;
+  const subcontext = subwin.AudioContext;
+  // Construct an AudioContext while the subdocument is fully active to start
+  // a MediaTrackGraph.
+  new subcontext();
+  // Unload the subdocument and wait for completion.
+  // This shuts down the MediaTrackGraph.
+  subwin.location.reload();
+  await new Promise(resolve => frame.onload = resolve);
+  // Test that a new AudioContext on the inactive subdocument does not attempt
+  // to use the shut-down MediaTrackGraph.
+  try { new subcontext() } catch {}
+  document.documentElement.removeAttribute('class');
+});
+</script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/audiocontext-after-xhr.html b/dom/media/test/crashtests/audiocontext-after-xhr.html
new file mode 100644
index 0000000000..a4dd9990ca
--- /dev/null
+++ b/dom/media/test/crashtests/audiocontext-after-xhr.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <script>
+      document.addEventListener('DOMContentLoaded', () => {
+        const xhr = new XMLHttpRequest()
+        xhr.open('G', '', false)
+        xhr.send()
+        window.ac = new AudioContext()
+      })
+    </script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/audiocontext-double-suspend.html b/dom/media/test/crashtests/audiocontext-double-suspend.html
new file mode 100644
index 0000000000..98399549bd
--- /dev/null
+++ b/dom/media/test/crashtests/audiocontext-double-suspend.html
@@ -0,0 +1,5 @@
+<script>
+var ac = new AudioContext();
+ac.resume();
+ac.resume();
+</script>
diff --git a/dom/media/test/crashtests/audioworkletnode-after-unload-1.html b/dom/media/test/crashtests/audioworkletnode-after-unload-1.html
new file mode 100644
index 0000000000..7da8d1161a
--- /dev/null
+++ b/dom/media/test/crashtests/audioworkletnode-after-unload-1.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<title>Test for bug 1634200 and bug 1655544</title>
+<script>
+document.addEventListener('DOMContentLoaded', async () => {
+  const frame = document.createElement('iframe');
+  document.body.appendChild(frame);
+  frame.srcdoc = '<html></html>';
+  await new Promise(resolve => frame.onload = resolve);
+
+  const subwin = frame.contentWindow;
+  const ctx = new subwin.AudioContext();
+  const url = URL.createObjectURL(
+    new Blob([`registerProcessor("noop",
+                                 class extends AudioWorkletProcessor {})`]),
+    {type: "application/javascript"});
+  await ctx.audioWorklet.addModule(url);
+
+  frame.remove();
+  new subwin.AudioWorkletNode(ctx, 'noop')
+
+  document.documentElement.removeAttribute('class');
+});
+</script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/buffer-source-duration-1.html b/dom/media/test/crashtests/buffer-source-duration-1.html
new file mode 100644
index 0000000000..df8d7a37d5
--- /dev/null
+++ b/dom/media/test/crashtests/buffer-source-duration-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+const rate = 44100;
+var context = new window.OfflineAudioContext(1, 512, rate);
+var buffer = context.createBuffer(1, 128, rate);
+var source = context.createBufferSource();
+source.buffer = buffer;
+source.start(0, 0, 86400);
+context.startRendering().
+  then(function() {
+    document.documentElement.removeAttribute("class");
+  });
+</script>
diff --git a/dom/media/test/crashtests/buffer-source-ended-1.html b/dom/media/test/crashtests/buffer-source-ended-1.html
new file mode 100644
index 0000000000..de8546316c
--- /dev/null
+++ b/dom/media/test/crashtests/buffer-source-ended-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var context = new AudioContext();
+
+var source = context.createBufferSource();
+source.buffer = context.createBuffer(1, 2.0 * context.sampleRate, context.sampleRate);
+source.onended = function(e) {
+  document.documentElement.removeAttribute("class");
+}
+source.start(0.0, 1.0);
+setTimeout(
+    function() {
+        source.buffer = context.createBuffer(1, 1, context.sampleRate);
+    }, 0);
+</script>
diff --git a/dom/media/test/crashtests/buffer-source-resampling-start-1.html b/dom/media/test/crashtests/buffer-source-resampling-start-1.html
new file mode 100644
index 0000000000..55db8591ed
--- /dev/null
+++ b/dom/media/test/crashtests/buffer-source-resampling-start-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+const rate = 44101; // not divisible by 2
+var context = new window.OfflineAudioContext(1, 512, rate);
+var buffer = context.createBuffer(1, 128, rate);
+buffer.getChannelData(0)[0] = 1.0;
+var source = context.createBufferSource();
+source.buffer = buffer;
+source.playbackRate.value = rate / (Math.pow(2, 30) * 1.0000001);
+source.start(512 / rate);
+context.startRendering().
+  then(function() {
+    document.documentElement.removeAttribute("class");
+  });
+</script>
diff --git a/dom/media/test/crashtests/buffer-source-slow-resampling-1.html b/dom/media/test/crashtests/buffer-source-slow-resampling-1.html
new file mode 100644
index 0000000000..5d8a50442b
--- /dev/null
+++ b/dom/media/test/crashtests/buffer-source-slow-resampling-1.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+const blockSize = 128;
+// The sample rate is a prime number so that the resampler is not expected to
+// simplify in/out fractions.
+const rate = 44101;
+var context = new window.OfflineAudioContext(1, 3 * blockSize, rate);
+// Non-zero buffer, so it can't be optimized away.
+var buffer = context.createBuffer(1, 128, rate);
+buffer.getChannelData(0)[0] = 1.0;
+var source = context.createBufferSource();
+source.buffer = buffer;
+source.loop = true;
+// Initialize the resampler with a slow input rate. 
+// With the current (Mar 2017) implementation, very slow rates give the
+// resampler a very large denominator.
+source.playbackRate.setValueAtTime(rate / 0x7fffffff, 0.0);
+// Change to a moderate input rate.
+// With the current implementation, skip_frac_num increases by den_rate for
+// each output sample and so one block before the change in playback rate is
+// enough for high skip_frac_num at the time of the change.
+const changeBlock = 1;
+const changeBlockSeconds = changeBlock * blockSize / rate;
+// With the current speex_resampler_set_rate_frac() implementation, the
+// moderate resampler denominator is still large enough to trigger overflow of
+// 32-bit unsigned integer arithmetic.
+source.playbackRate.setValueAtTime(rate / (rate + 1), changeBlockSeconds);
+source.start(0);
+context.startRendering().
+  then(function() {
+    document.documentElement.removeAttribute("class");
+  });
+</script>
diff --git a/dom/media/test/crashtests/channel-count-in-metadata-different-than-in-content.mp4 b/dom/media/test/crashtests/channel-count-in-metadata-different-than-in-content.mp4
new file mode 100644
index 0000000000..92bf3722f2
Binary files /dev/null and b/dom/media/test/crashtests/channel-count-in-metadata-different-than-in-content.mp4 differ
diff --git a/dom/media/test/crashtests/convolver-memory-report-1.html b/dom/media/test/crashtests/convolver-memory-report-1.html
new file mode 100644
index 0000000000..a49a281d1c
--- /dev/null
+++ b/dom/media/test/crashtests/convolver-memory-report-1.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+  <title>Bug 1481745: Exercise ConvolverNode memory reporting</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script>
+let context = new AudioContext();
+let response = new AudioBuffer({length: 128,
+                                sampleRate: context.sampleRate});
+response.getChannelData(0)[response.length - 1] = 1;
+let convolver = new ConvolverNode(context,
+                                  {disableNormalization: true,
+                                   buffer: response});
+convolver.connect(context.destination);
+let osc = new OscillatorNode(context);
+osc.connect(convolver);
+osc.start();
+osc.stop(128/context.sampleRate);
+osc.onended = (e) => {
+  SpecialPowers.getMemoryReports();
+  document.documentElement.removeAttribute("class");
+};
+  </script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/copyFromChannel-2.html b/dom/media/test/crashtests/copyFromChannel-2.html
new file mode 100644
index 0000000000..8d3d5a2124
--- /dev/null
+++ b/dom/media/test/crashtests/copyFromChannel-2.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Crashtest for bug 1548816</title>
+  <script>
+let cx = new OfflineAudioContext({numberOfChannels: 1,
+                                  length: 1, sampleRate: 44100});
+let buffer = new AudioBuffer({numberOfChannels: 13,
+                              length: 22050, sampleRate: 44100});
+buffer.getChannelData(12)[0] = 1.0;
+let o2248 = new AudioBufferSourceNode(cx, {buffer: buffer});
+let array = new Float32Array(52428);
+buffer.copyFromChannel(array, 12);
+  </script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/cors.webm b/dom/media/test/crashtests/cors.webm
new file mode 100644
index 0000000000..72b0297233
Binary files /dev/null and b/dom/media/test/crashtests/cors.webm differ
diff --git a/dom/media/test/crashtests/cors.webm^headers^ b/dom/media/test/crashtests/cors.webm^headers^
new file mode 100644
index 0000000000..cb762eff80
--- /dev/null
+++ b/dom/media/test/crashtests/cors.webm^headers^
@@ -0,0 +1 @@
+Access-Control-Allow-Origin: *
diff --git a/dom/media/test/crashtests/crashtests.list b/dom/media/test/crashtests/crashtests.list
new file mode 100644
index 0000000000..0a420d9e1f
--- /dev/null
+++ b/dom/media/test/crashtests/crashtests.list
@@ -0,0 +1,169 @@
+skip-if(OSX) load 1185191.html # this needs to run near the beginning of the test suite
+load 0-timescale.html # bug 1229166
+skip-if(Android) pref(media.autoplay.default,0) load 459439-1.html # bug 888557
+load 466607-1.html
+load 466945-1.html
+load 468763-1.html
+load 474744-1.html
+HTTP load 481136-1.html # needs to be HTTP to recognize the ogg as an audio file?
+load 492286-1.xhtml
+load 493915-1.html
+pref(media.autoplay.default,0) load 495794-1.html
+load 497734-1.xhtml
+load 497734-2.html
+load 576612-1.html
+load 752784-1.html
+skip-if(Android) load 789075-1.html # bug 1374405 for android
+skip-if(Android&&AndroidVersion=='22') HTTP load 795892-1.html # bug 1358718
+load 844563.html
+load 846612.html
+load 852838.html
+load 865004.html
+load 865537-1.html
+load 865550.html
+load 868504.html
+load 874869.html
+load 874915.html
+load 874934.html
+load 874952.html
+load 875144.html
+load 875596.html
+load 875911.html
+load 876024-1.html
+load 876024-2.html
+load 876118.html
+load 876207.html
+load 876215.html
+load 876249.html
+load 876252.html
+load 876834.html
+load 877527.html
+load 877820.html
+load 878014.html
+load 878328.html
+load 878407.html
+load 878478.html
+load 880129.html
+load 880202.html
+load 880342-1.html
+load 880342-2.html
+load 880384.html
+load 880404.html
+load 880724.html
+load 881775.html
+load 882956.html
+load 884459.html
+load 889042.html
+load 907986-1.html
+load 907986-2.html
+load 907986-3.html
+load 907986-4.html
+load 910171-1.html
+load 920987.html
+load 925619-1.html
+load 925619-2.html
+load 926619.html
+load 933151.html
+load 933156.html
+load 944851.html
+load 952756.html
+load 986901.html
+load 990794.html
+load 995289.html
+load 1012609.html
+load 1015662.html
+skip-if(Android) test-pref(media.navigator.permission.disabled,true) load 1028458.html # bug 1048863
+load 1041466.html
+load 1045650.html
+load 1080986.html
+skip-if(Android&&AndroidVersion=='21') load 1180881.html # bug 1409365
+load 1197935.html
+load 1122218.html
+load 1127188.html
+load 1157994.html
+load 1158427.html
+load 1185176.html
+load 1185192.html
+skip-if(Android) load 1257700.html # bug 1575666
+load 1267263.html
+load 1270303.html
+load 1368490.html
+load 1291702.html
+load 1378826.html
+load 1384248.html
+load 1389304.html
+load 1393272.webm
+load 1411322.html
+load 1450845.html
+load 1489160.html
+load disconnect-wrong-destination.html
+load analyser-channels-1.html
+load audiocontext-after-unload-1.html
+load audiocontext-after-xhr.html
+load audiocontext-double-suspend.html
+skip-if(Android) load audioworkletnode-after-unload-1.html # Needs secure context
+load buffer-source-duration-1.html
+load buffer-source-ended-1.html
+load buffer-source-resampling-start-1.html
+load buffer-source-slow-resampling-1.html
+load convolver-memory-report-1.html
+load copyFromChannel-2.html
+load empty-buffer-source.html
+HTTP load media-element-source-seek-1.html
+load offline-buffer-source-ended-1.html
+load oscillator-ended-1.html
+load oscillator-ended-2.html
+skip-if(Android&&AndroidVersion=='22') load video-replay-after-audio-end.html # bug 1315125, bug 1358876
+# This needs to run at the end to avoid leaking busted state into other tests.
+skip-if(Android||ThreadSanitizer) load 691096-1.html # Bug 1365451
+load 1236639.html
+test-pref(media.navigator.permission.disabled,true) test-pref(media.devices.insecure.enabled,true) test-pref(media.getusermedia.insecure.enabled,true) load 1388372.html
+load 1494073.html
+skip-if(Android) load 1526044.html # Bug 1528391
+load 1530897.webm
+skip-if(Android&&AndroidVersion<21) load encrypted-track-with-bad-sample-description-index.mp4 # Bug 1533211, unkip after bug 1550912
+load encrypted-track-without-tenc.mp4 # Bug 1533215
+asserts-if(Android,0-1) load encrypted-track-with-sample-missing-cenc-aux.mp4 # Bug 1533625, bug 1588967
+load 1538727.html
+load empty-samples.webm # Bug 1540580
+test-pref(media.autoplay.block-webaudio,false) load 1545133.html
+load track-with-zero-dimensions.mp4 # Bug 1542539
+load 1560215.html
+skip-if(Android) load 1547784.html # Skip on Android as clearkey is not supported
+load 1547899.html
+load 1569645.html
+load 1575271.html
+load 1577184.html
+pref(media.autoplay.default,0) load 1587248.html
+load 1594466.html
+load 1601385.html
+load 1601422.html
+load 1604941.html
+pref(media.autoplay.default,0) load 1673525.html
+skip-if(!winWidget) load 1608286.html
+load channel-count-in-metadata-different-than-in-content.mp4 # Bug 1584959
+load mp4_box_emptyrange.mp4 # Bug 1667480
+load 1673526-1.html
+load 1673526-2.html
+load 1693043.html
+load 1696511.html
+load 1697521.html
+load 1708790.html
+skip-if(cocoaWidget) load 1709130.html # video failed decoding on MacOS, 1709684
+skip-if(appleSilicon) load 1517199.html
+load 1734008.html
+load 1741677.html
+load 1748272.html
+load 1752917.html
+load 1762620.html
+load 1765842.html
+load adts.aac # Bug 1770073
+load 1787281.html
+load 1798778.html
+load 1830206.html
+load 1830206.html
+load 1833896.mp4
+load 1833894.mp4
+load 1835164.html
+load 1840002.webm
+load 1845350.mp4
diff --git a/dom/media/test/crashtests/disconnect-wrong-destination.html b/dom/media/test/crashtests/disconnect-wrong-destination.html
new file mode 100644
index 0000000000..515ca3c877
--- /dev/null
+++ b/dom/media/test/crashtests/disconnect-wrong-destination.html
@@ -0,0 +1,13 @@
+<script>
+  var oc = new OfflineAudioContext(1, 1, 44100);
+  var splitter = oc.createChannelSplitter(2);
+  var merger0 = oc.createChannelMerger(2);
+  var merger1 = oc.createChannelMerger(2);
+  splitter.connect(merger0, 0);
+  splitter.connect(merger0, 1);
+  splitter.connect(merger1, 0);
+  splitter.connect(merger1, 1);
+
+  splitter.disconnect(merger0, 0);
+  splitter.disconnect(merger1, 1);
+</script>
diff --git a/dom/media/test/crashtests/doppler-1.html b/dom/media/test/crashtests/doppler-1.html
new file mode 100644
index 0000000000..2af3c8f460
--- /dev/null
+++ b/dom/media/test/crashtests/doppler-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var context = new window.AudioContext();
+var source = context.createBufferSource();
+source.buffer = context.createBuffer(1, 1, context.sampleRate);
+source.onended =
+  function(e) {
+    setTimeout(
+      function() {
+        var panner = context.createPanner();
+        source.connect(panner);
+        panner.setVelocity(1.0, 0.0, 0.0);
+        setTimeout(
+          function() {
+            document.documentElement.removeAttribute("class");
+          },
+          0);
+      },
+      0);
+  };
+source.start(0);
+</script>
diff --git a/dom/media/test/crashtests/empty-buffer-source.html b/dom/media/test/crashtests/empty-buffer-source.html
new file mode 100644
index 0000000000..2ce48a9ec1
--- /dev/null
+++ b/dom/media/test/crashtests/empty-buffer-source.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+  <title>Bug 1636540: AudioBufferSourceNode with empty buffer</title>
+  <script>
+const offline = new OfflineAudioContext({length: 128, sampleRate: 16384});
+const buffer = new AudioBuffer({length: 1, sampleRate: 21725});
+const node = new AudioBufferSourceNode(offline, {buffer: buffer});
+node.start(5/offline.sampleRate);
+offline.startRendering().then(
+  () => document.documentElement.removeAttribute("class"));
+  </script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/empty-samples.webm b/dom/media/test/crashtests/empty-samples.webm
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/dom/media/test/crashtests/encrypted-track-with-bad-sample-description-index.mp4 b/dom/media/test/crashtests/encrypted-track-with-bad-sample-description-index.mp4
new file mode 100644
index 0000000000..32303f0357
Binary files /dev/null and b/dom/media/test/crashtests/encrypted-track-with-bad-sample-description-index.mp4 differ
diff --git a/dom/media/test/crashtests/encrypted-track-with-sample-missing-cenc-aux.mp4 b/dom/media/test/crashtests/encrypted-track-with-sample-missing-cenc-aux.mp4
new file mode 100644
index 0000000000..875c5dca76
Binary files /dev/null and b/dom/media/test/crashtests/encrypted-track-with-sample-missing-cenc-aux.mp4 differ
diff --git a/dom/media/test/crashtests/encrypted-track-without-tenc.mp4 b/dom/media/test/crashtests/encrypted-track-without-tenc.mp4
new file mode 100644
index 0000000000..188faebf1b
Binary files /dev/null and b/dom/media/test/crashtests/encrypted-track-without-tenc.mp4 differ
diff --git a/dom/media/test/crashtests/media-element-source-seek-1.html b/dom/media/test/crashtests/media-element-source-seek-1.html
new file mode 100644
index 0000000000..5c3aed5ae7
--- /dev/null
+++ b/dom/media/test/crashtests/media-element-source-seek-1.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var audioElement = document.createElement("audio");
+audioElement.autoplay = true;
+audioElement.src = "sound.ogg";
+audioElement.onplaying =
+  function() {
+    audioElement.onplaying = null;
+    setTimeout(
+      function() {
+        audioElement.onseeked =
+          function() {
+            // Note we reset 'src' to release decoder resources and cubeb
+            // streams to prevent OOM or OpenCubeb() failures.
+            audioElement.src = "";
+            document.documentElement.removeAttribute("class");
+          };
+        audioElement.currentTime = 0;
+      }, 100);
+  };
+
+var context = new window.AudioContext();
+var source = context.createMediaElementSource(audioElement);
+source.connect(context.destination);
+</script>
+</html>
diff --git a/dom/media/test/crashtests/mp4_box_emptyrange.mp4 b/dom/media/test/crashtests/mp4_box_emptyrange.mp4
new file mode 100644
index 0000000000..83057533a0
Binary files /dev/null and b/dom/media/test/crashtests/mp4_box_emptyrange.mp4 differ
diff --git a/dom/media/test/crashtests/offline-buffer-source-ended-1.html b/dom/media/test/crashtests/offline-buffer-source-ended-1.html
new file mode 100644
index 0000000000..0631021126
--- /dev/null
+++ b/dom/media/test/crashtests/offline-buffer-source-ended-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var context = new window.OfflineAudioContext(1, 12001, 12000);
+
+var source = context.createBufferSource();
+source.buffer = context.createBuffer(1, 12000, context.sampleRate);
+source.onended = function(e) {
+  document.documentElement.removeAttribute("class");
+}
+source.connect(context.destination);
+source.start(0);
+
+context.startRendering();
+</script>
diff --git a/dom/media/test/crashtests/oscillator-ended-1.html b/dom/media/test/crashtests/oscillator-ended-1.html
new file mode 100644
index 0000000000..831111261c
--- /dev/null
+++ b/dom/media/test/crashtests/oscillator-ended-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+function createContext() {
+  var context = new window.AudioContext();
+  var source = context.createOscillator();
+  source.onended = function(e) {
+    document.documentElement.removeAttribute("class");
+  };
+  source.connect(context.destination);
+  source.start(0.49);
+  source.stop(0.5);
+}
+createContext();
+</script>
diff --git a/dom/media/test/crashtests/oscillator-ended-2.html b/dom/media/test/crashtests/oscillator-ended-2.html
new file mode 100644
index 0000000000..ee9b8cf300
--- /dev/null
+++ b/dom/media/test/crashtests/oscillator-ended-2.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+function createContext() {
+  var context = new window.AudioContext();
+  var source = context.createOscillator();
+  source.onended = function(e) {
+    document.documentElement.removeAttribute("class");
+  };
+  source.connect(context.destination);
+  source.start(60);
+  source.stop(0.5);
+}
+createContext();
+</script>
diff --git a/dom/media/test/crashtests/sound.ogg b/dom/media/test/crashtests/sound.ogg
new file mode 100644
index 0000000000..edda4e9128
Binary files /dev/null and b/dom/media/test/crashtests/sound.ogg differ
diff --git a/dom/media/test/crashtests/test.mp4 b/dom/media/test/crashtests/test.mp4
new file mode 100644
index 0000000000..44d7ee9cbc
Binary files /dev/null and b/dom/media/test/crashtests/test.mp4 differ
diff --git a/dom/media/test/crashtests/track-with-zero-dimensions.mp4 b/dom/media/test/crashtests/track-with-zero-dimensions.mp4
new file mode 100644
index 0000000000..3f4a1317f3
Binary files /dev/null and b/dom/media/test/crashtests/track-with-zero-dimensions.mp4 differ
diff --git a/dom/media/test/crashtests/video-crash.webm b/dom/media/test/crashtests/video-crash.webm
new file mode 100644
index 0000000000..9532113d87
Binary files /dev/null and b/dom/media/test/crashtests/video-crash.webm differ
diff --git a/dom/media/test/crashtests/video-replay-after-audio-end.html b/dom/media/test/crashtests/video-replay-after-audio-end.html
new file mode 100644
index 0000000000..9ffd6078de
--- /dev/null
+++ b/dom/media/test/crashtests/video-replay-after-audio-end.html
@@ -0,0 +1,43 @@
+<html class="reftest-wait">
+<head>
+  <title> Bug 1242774 : video crashed if pause and play again after audio track ends </title>
+</head>
+<body>
+<script type="text/javascript">
+function assert(value, msg) {
+  if (!value) {
+    dump("### Error : " + msg + "\n");
+  }
+}
+
+var AUDIO_END_TIME = 4.5;
+var video = document.createElement('video');
+video.src = "video-crash.webm";
+video.play();
+
+video.ontimeupdate = function () {
+  assert(AUDIO_END_TIME < video.duration,
+         "AUDIO_END_TIME should be smaller than the duration!");
+
+  if (video.currentTime > AUDIO_END_TIME) {
+    dump("### Pause video during silent part.\n");
+    video.ontimeupdate = null;
+    video.pause();
+  }
+
+  video.onpause = function () {
+    video.onpause = null;
+    setTimeout(function() {
+      dump("### Re-play after pausing during silent part.\n");
+      video.play();
+      video.onended = function () {
+        video.onended = null;
+        dump("### Video is ended.\n");
+        document.documentElement.removeAttribute("class");
+      }
+    }, 1000);
+  }
+}
+</script>
+</body>
+</html>
\ No newline at end of file
-- 
cgit v1.2.3