7 files changed, 93 insertions, 0 deletions
diff --git a/dom/indexedDB/crashtests/1499854-1.html b/dom/indexedDB/crashtests/1499854-1.html
new file mode 100644
index 0000000000..0e10601134
--- /dev/null
+++ b/dom/indexedDB/crashtests/1499854-1.html
@@ -0,0 +1,29 @@
+<html>
+
+<head>
+  <script>
+    function start() {
+      o1 = new Int32Array(51488)
+      o2 = new ArrayBuffer(13964)
+      for (let i = 0; i < 51488; i++) o1[i] = 0x41
+      const dbRequest = window.indexedDB.open('', {})
+      dbRequest.onupgradeneeded = function(event) {
+        const store = event.target.result.createObjectStore('IDBStore_0', {})
+        store.add({}, 'ObjectKey_0')
+        store.add({
+          data: undefined,
+          index_key_0: o1,
+          index_key_1: o2
+        }, 'ObjectKey_1')
+        store.createIndex('IDBIndex_1', ['index_key_0', 'index_key_1'], {
+          unique: false,
+          multiEntry: false,
+          locale: 'fr'
+        })
+      }
+    }
+    document.addEventListener('DOMContentLoaded', start)
+  </script>
+</head>
+
+</html>
diff --git a/dom/indexedDB/crashtests/1505821-1.html b/dom/indexedDB/crashtests/1505821-1.html
new file mode 100644
index 0000000000..da4bd31ab3
--- /dev/null
+++ b/dom/indexedDB/crashtests/1505821-1.html
@@ -0,0 +1,16 @@
+<script>
+  const dbRequest = window.indexedDB.open('bug1505821_1_hello');
+  dbRequest.onupgradeneeded = function (event) {
+    const store = event.target.result.createObjectStore('IDBStore_1', {autoIncrement: true});
+    store.createIndex('I', [''], {unique: true});
+    store.createIndex('J', ['a', ''], {unique: true});
+    store.createIndex('M', ['', 'a'], {unique: true});
+    store.createIndex('K', ['', 'a', ''], {unique: true});
+    store.createIndex('L', ['', '', ''], {unique: true});
+  }
+
+  const dbRequest2 = window.indexedDB.open('bug1505821_1_hello');
+  dbRequest.onsuccess = function (event) {
+    window.indexedDB.deleteDatabase("bug1507229_1_hello");
+  }
+</script>
diff --git a/dom/indexedDB/crashtests/1543154-1.html b/dom/indexedDB/crashtests/1543154-1.html
new file mode 100644
index 0000000000..b40121ed43
--- /dev/null
+++ b/dom/indexedDB/crashtests/1543154-1.html
@@ -0,0 +1,11 @@
+<script>
+  window.addEventListener('load', () => {
+    let a = document.createElementNS('http://www.w3.org/1999/xhtml', 'frame')
+    document.documentElement.appendChild(a)
+    let b = a.contentWindow.indexedDB
+    while (document.documentElement.lastElementChild) {
+      document.documentElement.removeChild(document.documentElement.lastElementChild)
+    }
+    b.open('', { })
+  })
+</script>
diff --git a/dom/indexedDB/crashtests/1813284-1.html b/dom/indexedDB/crashtests/1813284-1.html
new file mode 100644
index 0000000000..fd1d8987bc
--- /dev/null
+++ b/dom/indexedDB/crashtests/1813284-1.html
@@ -0,0 +1,6 @@
+<script>
+  // This test allocates >= 4GB of memory even if it succeeds.
+  let a = new ArrayBuffer(4294967296)
+  let b = new Uint32Array(a)
+  self.indexedDB.cmp(b, undefined)
+</script>
diff --git a/dom/indexedDB/crashtests/1857979-1.html b/dom/indexedDB/crashtests/1857979-1.html
new file mode 100644
index 0000000000..d97aa24562
--- /dev/null
+++ b/dom/indexedDB/crashtests/1857979-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<script>
+  window.addEventListener('load', async () => {
+    const db1 = indexedDB.open('DB_1696052013002', {})
+    db1.onsuccess = () => window.close()
+    const blob = new Blob(['0'], {})
+    db2 = indexedDB.open('DB_1696052013003', {})
+    db2.onupgradeneeded = (e) => {
+      const store = e.target.result.createObjectStore('IDBStore_0', {
+        'autoIncrement': true,
+      }, 'ObjectKey_0')
+      store.put({ store_key_1: blob })
+      const index = store.createIndex('IDBIndex_2', ['index_key_3'], {})
+      store.mozGetAll()
+      store.transaction.commit()
+    }
+  })
+</script>
diff --git a/dom/indexedDB/crashtests/726376-1.html b/dom/indexedDB/crashtests/726376-1.html
new file mode 100644
index 0000000000..4187678fa8
--- /dev/null
+++ b/dom/indexedDB/crashtests/726376-1.html
@@ -0,0 +1,7 @@
+<script>
+
+var a = [];
+a[0] = a;
+indexedDB.cmp.bind(indexedDB)(a, a);
+
+</script>
diff --git a/dom/indexedDB/crashtests/crashtests.list b/dom/indexedDB/crashtests/crashtests.list
new file mode 100644
index 0000000000..2aeb2f897d
--- /dev/null
+++ b/dom/indexedDB/crashtests/crashtests.list
@@ -0,0 +1,6 @@
+load 726376-1.html
+load 1499854-1.html
+load 1505821-1.html
+load 1543154-1.html
+skip-if(!is64Bit) skip-if(Android) skip-if(AddressSanitizer) skip-if(ThreadSanitizer) load 1813284-1.html
+skip-if(Android) load 1857979-1.html