5 files changed, 75 insertions, 0 deletions
diff --git a/dom/media/webcodecs/crashtests/1839270.html b/dom/media/webcodecs/crashtests/1839270.html
new file mode 100644
index 0000000000..3b8f7908e5
--- /dev/null
+++ b/dom/media/webcodecs/crashtests/1839270.html
@@ -0,0 +1,13 @@
+<script>
+window.addEventListener("load", async () => {
+  let _ = new Response("", {"headers": []})
+  let a = new ArrayBuffer(60005)
+  let v = new VideoFrame(a, {
+    "format": "RGBA",
+    "codedWidth": 1458585599,
+    "codedHeight": 84,
+    "timestamp": 0.541,
+    "layout": [{"offset": 168, "stride": 198}],
+  })
+})
+</script>
diff --git a/dom/media/webcodecs/crashtests/1848460.html b/dom/media/webcodecs/crashtests/1848460.html
new file mode 100644
index 0000000000..2f6f8b930e
--- /dev/null
+++ b/dom/media/webcodecs/crashtests/1848460.html
@@ -0,0 +1,17 @@
+<script id="worker" type="javascript/worker">
+self.onmessage = async function(e) {
+  let a = new ArrayBuffer(12583)
+  let b = new DataView(a)
+  await VideoDecoder.isConfigSupported({
+    "codec": "7󠎢ﷺ۹.9",
+    "description": b,
+  })
+}
+</script>
+<script>
+window.addEventListener("load", async () => {
+  const blob = new Blob([document.querySelector('#worker').textContent], { type: "text/javascript" })
+  const worker = new Worker(window.URL.createObjectURL(blob))
+  worker.postMessage([], [])
+})
+</script>
diff --git a/dom/media/webcodecs/crashtests/1849271.html b/dom/media/webcodecs/crashtests/1849271.html
new file mode 100644
index 0000000000..67e170d8bf
--- /dev/null
+++ b/dom/media/webcodecs/crashtests/1849271.html
@@ -0,0 +1,27 @@
+<html class="reftest-wait">
+  <script>
+    var cfg = {
+      codec: "vp8",
+      colorSpace: { primaries: "bt709" },
+    };
+    var decoder = new VideoDecoder({
+      output: () => {},
+      error: e => {
+        document.documentElement.removeAttribute("class");
+      },
+    });
+    decoder.configure(cfg);
+    try {
+      decoder.decode(
+        new EncodedVideoChunk({
+          type: "key",
+          timestamp: 0,
+          duration: 10,
+          data: new Uint8Array(10),
+        })
+      );
+    } catch (e) {
+      document.documentElement.removeAttribute("class");
+    }
+  </script>
+</html>
diff --git a/dom/media/webcodecs/crashtests/1864475.html b/dom/media/webcodecs/crashtests/1864475.html
new file mode 100644
index 0000000000..d7164b2854
--- /dev/null
+++ b/dom/media/webcodecs/crashtests/1864475.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<script>
+  document.addEventListener('DOMContentLoaded', async () => {
+    const buffer = new ArrayBuffer(26838)
+    const array = new Uint8ClampedArray(buffer)
+    const frame = new VideoFrame(array, {
+      'format': 'I420A',
+      'codedWidth': 192,
+      'codedHeight': 2,
+      'timestamp': 14.19024535832334,
+    })
+    await frame.copyTo(buffer, {})
+  })
+</script>
diff --git a/dom/media/webcodecs/crashtests/crashtests.list b/dom/media/webcodecs/crashtests/crashtests.list
new file mode 100644
index 0000000000..cea5139fe9
--- /dev/null
+++ b/dom/media/webcodecs/crashtests/crashtests.list
@@ -0,0 +1,4 @@
+skip-if(Android) pref(dom.media.webcodecs.enabled,true) load 1839270.html
+skip-if(Android) pref(dom.media.webcodecs.enabled,true) load 1848460.html
+skip-if(Android) pref(dom.media.webcodecs.enabled,true) load 1849271.html
+skip-if(Android) pref(dom.media.webcodecs.enabled,true) load 1864475.html
+\ No newline at end of file