9 files changed, 142 insertions, 0 deletions
diff --git a/dom/fs/test/crashtests/1798773.html b/dom/fs/test/crashtests/1798773.html
new file mode 100644
index 0000000000..893dfcfc59
--- /dev/null
+++ b/dom/fs/test/crashtests/1798773.html
@@ -0,0 +1,19 @@
+<script id="worker1" type="javascript/worker">
+self.onmessage = async function () {
+  const xhr = new XMLHttpRequest()
+  self.onerror = () => {
+    xhr.open("POST", "FOOBAR", false)
+    xhr.send()
+  }
+  self.reportError(undefined)
+  self.dir = await self.navigator.storage.getDirectory()
+}
+</script>
+<script>
+window.addEventListener('load', async () => {
+  const blob = new Blob([document.querySelector('#worker1').textContent], { type: "text/javascript" })
+  let worker = new Worker(window.URL.createObjectURL(blob))
+  worker.postMessage([], [])
+  setTimeout(() => {window.location.reload(true)})
+})
+</script>
diff --git a/dom/fs/test/crashtests/1800470.html b/dom/fs/test/crashtests/1800470.html
new file mode 100644
index 0000000000..a7d5dfa8bb
--- /dev/null
+++ b/dom/fs/test/crashtests/1800470.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+  <script id="worker1" type="javascript/worker">
+    self.onmessage = async function (e) {
+      const directory = await navigator.storage.getDirectory();
+      const file = await directory.getFileHandle("500014c3-f683-4551-bb26-08025c9be332", {
+        create: true,
+      });
+      const stream = await file.createWritable({});
+      const regex = new RegExp(".*");
+      await stream.abort(regex);
+      self.postMessage("done");
+      self.close();
+    }
+  </script>
+  <script>
+    var worker;
+    document.addEventListener('DOMContentLoaded', () => {
+      const buffer = new ArrayBuffer(1);
+      const blob = new Blob([document.querySelector('#worker1').textContent], { type: 'text/javascript' });
+      worker = new Worker(window.URL.createObjectURL(blob));
+      worker.postMessage([buffer], [buffer]);
+      worker.onmessage = function() {document.documentElement.removeAttribute("class"); }
+    });
+  </script>
+</head>
+</html>
diff --git a/dom/fs/test/crashtests/1809759.html b/dom/fs/test/crashtests/1809759.html
new file mode 100644
index 0000000000..b9df8de02f
--- /dev/null
+++ b/dom/fs/test/crashtests/1809759.html
@@ -0,0 +1,10 @@
+<script>
+document.addEventListener('DOMContentLoaded', async () => {
+  document.location.search = '?'
+  let a = self.navigator.storage
+  let xhr = new XMLHttpRequest()
+  xhr.open('POST', 'FOOBAR', false)
+  xhr.send()
+  await a.getDirectory()
+})
+</script>
diff --git a/dom/fs/test/crashtests/1816710.html b/dom/fs/test/crashtests/1816710.html
new file mode 100644
index 0000000000..f7641e009d
--- /dev/null
+++ b/dom/fs/test/crashtests/1816710.html
@@ -0,0 +1,8 @@
+<script>
+  window.addEventListener('load', async () => {
+    const dir = await navigator.storage.getDirectory();
+    const file = await dir.getFileHandle('555b8afb-96ac-4fe3-8cec', { create: true });
+    const writable = await file.createWritable({});
+    setTimeout('self.close()', 2000)
+  })
+</script>
diff --git a/dom/fs/test/crashtests/1841702.html b/dom/fs/test/crashtests/1841702.html
new file mode 100644
index 0000000000..0509972ae8
--- /dev/null
+++ b/dom/fs/test/crashtests/1841702.html
@@ -0,0 +1,16 @@
+<script id="worker1" type="javascript/worker">
+self.onmessage = async function(e) {
+    let a = await e.data[0].getFileHandle("c21deba4-fb73-4407-94f8-2e3782bf3f23", {"create": true})
+    self.close()
+    await a.createWritable({})
+}
+</script>
+
+<script>
+window.addEventListener("load", async () => {
+    let a = await self.clientInformation.storage.getDirectory()
+    const blob = new Blob([document.querySelector('#worker1').textContent], { type: "text/javascript" })
+    let worker = new Worker(window.URL.createObjectURL(blob))
+    worker.postMessage([a], [])
+})
+</script>
diff --git a/dom/fs/test/crashtests/1844619.html b/dom/fs/test/crashtests/1844619.html
new file mode 100644
index 0000000000..43a85e94d9
--- /dev/null
+++ b/dom/fs/test/crashtests/1844619.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <script>
+      window.addEventListener('load', async () => {
+        await navigator.serviceWorker.register('sw1844619.js?1619678955', {})
+        await navigator.serviceWorker.register('sw1844619.js?4246054133', {})
+      })
+    </script>
+</head>
+</html>
diff --git a/dom/fs/test/crashtests/1858820.html b/dom/fs/test/crashtests/1858820.html
new file mode 100644
index 0000000000..ad758b96e0
--- /dev/null
+++ b/dom/fs/test/crashtests/1858820.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+  <script>
+    window.addEventListener("load", async () => {
+      let a = document.createElement("iframe")
+      document.documentElement.appendChild(a)
+      let b = await a.contentWindow.clientInformation.storage.getDirectory()
+      let c = await b.getFileHandle("80e2d2c3-0712-4ccd-94b5-e2dd1732ea09", {"create": true})
+      let d = await c.createWritable({ })
+      setTimeout(async () => {
+        document.documentElement.removeAttribute("class");
+        await d.truncate(1);
+      }, 1000)
+      document.replaceChildren(document.documentElement, document.documentElement)
+    })
+  </script>
+</head>
+</html>
diff --git a/dom/fs/test/crashtests/crashtests.list b/dom/fs/test/crashtests/crashtests.list
new file mode 100644
index 0000000000..a083cb80b2
--- /dev/null
+++ b/dom/fs/test/crashtests/crashtests.list
@@ -0,0 +1,10 @@
+# StorageManager isn't enabled on Android
+defaults skip-if(Android) pref(dom.fs.enabled,true) pref(dom.fs.writable_file_stream.enabled,true)
+
+load 1798773.html
+load 1800470.html
+load 1809759.html
+load 1816710.html
+load 1841702.html
+HTTP load 1844619.html
+HTTP load 1858820.html
diff --git a/dom/fs/test/crashtests/sw1844619.js b/dom/fs/test/crashtests/sw1844619.js
new file mode 100644
index 0000000000..dd221844f2
--- /dev/null
+++ b/dom/fs/test/crashtests/sw1844619.js
@@ -0,0 +1,21 @@
+async function timeout (cmd) {
+  const timer = new Promise((resolve, reject) => {
+    const id = setTimeout(() => {
+      clearTimeout(id)
+      reject(new Error('Promise timed out!'))
+    }, 750)
+  })
+  return Promise.race([cmd, timer])
+}
+
+(async () => {
+  const root = await navigator.storage.getDirectory()
+  const blob = new Blob(['A'])
+  const sub = await root.getDirectoryHandle('a', { 'create': true })
+  const file = await root.getFileHandle('b', { 'create': true })
+  await file.move(sub)
+  const stream = await file.createWritable({})
+  await stream.write(blob)
+  const sub2 = await root.getDirectoryHandle('a', {})
+  await sub2.move(root, 'X')
+})()