From 26a029d407be480d791972afb5975cf62c9360a6 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Fri, 19 Apr 2024 02:47:55 +0200
Subject: Adding upstream version 124.0.1.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 dom/canvas/crashtests/0px-size-font-667225.html |  19 +++++
 dom/canvas/crashtests/0px-size-font-shadow.html |  17 ++++
 dom/canvas/crashtests/1099143-1.html            |   5 ++
 dom/canvas/crashtests/1161277-1.html            |  22 +++++
 dom/canvas/crashtests/1183363.html              |  23 ++++++
 dom/canvas/crashtests/1190705.html              |  17 ++++
 dom/canvas/crashtests/1223740-1.html            |  22 +++++
 dom/canvas/crashtests/1225381-1.html            |  17 ++++
 dom/canvas/crashtests/1229932-1.html            |  16 ++++
 dom/canvas/crashtests/1229983-1.html            |  24 ++++++
 dom/canvas/crashtests/1233613.html              |  19 +++++
 dom/canvas/crashtests/1244850-1.html            |  22 +++++
 dom/canvas/crashtests/1246775-1.html            |  15 ++++
 dom/canvas/crashtests/1283113-1.html            |  25 ++++++
 dom/canvas/crashtests/1284356-1.html            |   9 +++
 dom/canvas/crashtests/1284578-1.html            |   8 ++
 dom/canvas/crashtests/1286458-1.html            |  20 +++++
 dom/canvas/crashtests/1287515-1.html            |   7 ++
 dom/canvas/crashtests/1287652-1.html            |   8 ++
 dom/canvas/crashtests/1288872-1.html            |   6 ++
 dom/canvas/crashtests/1290628-1.html            |  13 +++
 dom/canvas/crashtests/1296410-1.html            |   9 +++
 dom/canvas/crashtests/1298576-1.html            |  21 +++++
 dom/canvas/crashtests/1299062-1.html            |   5 ++
 dom/canvas/crashtests/1305085-1.html            |   9 +++
 dom/canvas/crashtests/1305312-1.html            |   5 ++
 dom/canvas/crashtests/1305850.html              |  11 +++
 dom/canvas/crashtests/1334366-1.html            |   8 ++
 dom/canvas/crashtests/1334647-1.html            |   8 ++
 dom/canvas/crashtests/1348976-1.html            |  13 +++
 dom/canvas/crashtests/1349067.html              |  10 +++
 dom/canvas/crashtests/1357092.html              |  10 +++
 dom/canvas/crashtests/1441613.html              |  19 +++++
 dom/canvas/crashtests/1443671.html              |   8 ++
 dom/canvas/crashtests/1546390.html              |  11 +++
 dom/canvas/crashtests/1549853.html              |   8 ++
 dom/canvas/crashtests/1551745.html              |   9 +++
 dom/canvas/crashtests/1569648.html              |   5 ++
 dom/canvas/crashtests/1654477.html              |  26 ++++++
 dom/canvas/crashtests/1739454-1.html            |  17 ++++
 dom/canvas/crashtests/1740031.html              |  12 +++
 dom/canvas/crashtests/1744172.html              |  17 ++++
 dom/canvas/crashtests/1757755.html              |  18 +++++
 dom/canvas/crashtests/1757925-1.html            |  15 ++++
 dom/canvas/crashtests/1769878.html              |  15 ++++
 dom/canvas/crashtests/1771007-1.html            |  22 +++++
 dom/canvas/crashtests/1816140.html              |  17 ++++
 dom/canvas/crashtests/1849704-1.html            |  36 +++++++++
 dom/canvas/crashtests/1857986.html              |  16 ++++
 dom/canvas/crashtests/1873790.html              |   9 +++
 dom/canvas/crashtests/360293-1.html             |  35 ++++++++
 dom/canvas/crashtests/421715-1.html             |  41 ++++++++++
 dom/canvas/crashtests/553938-1.html             |  20 +++++
 dom/canvas/crashtests/647480.html               | 102 ++++++++++++++++++++++++
 dom/canvas/crashtests/727547.html               |   7 ++
 dom/canvas/crashtests/729116.html               |  18 +++++
 dom/canvas/crashtests/743499-negative-size.html |  22 +++++
 dom/canvas/crashtests/745699-1.html             |  25 ++++++
 dom/canvas/crashtests/745818-large-source.html  |  21 +++++
 dom/canvas/crashtests/746813-1.html             |   6 ++
 dom/canvas/crashtests/767337-1.html             |  21 +++++
 dom/canvas/crashtests/779426.html               |  19 +++++
 dom/canvas/crashtests/780392-1.html             |  10 +++
 dom/canvas/crashtests/789933-1.html             |  13 +++
 dom/canvas/crashtests/794463-1.html             |  17 ++++
 dom/canvas/crashtests/802926-1.html             |   6 ++
 dom/canvas/crashtests/844280.html               |  18 +++++
 dom/canvas/crashtests/896047-1.html             |  17 ++++
 dom/canvas/crashtests/896047-2.html             |  19 +++++
 dom/canvas/crashtests/916128-1.html             |  13 +++
 dom/canvas/crashtests/934939-1.html             |   8 ++
 dom/canvas/crashtests/989628.html               |   9 +++
 dom/canvas/crashtests/crashtests.list           |  70 ++++++++++++++++
 dom/canvas/crashtests/texImage2D.html           |   8 ++
 74 files changed, 1268 insertions(+)
 create mode 100644 dom/canvas/crashtests/0px-size-font-667225.html
 create mode 100644 dom/canvas/crashtests/0px-size-font-shadow.html
 create mode 100644 dom/canvas/crashtests/1099143-1.html
 create mode 100644 dom/canvas/crashtests/1161277-1.html
 create mode 100644 dom/canvas/crashtests/1183363.html
 create mode 100644 dom/canvas/crashtests/1190705.html
 create mode 100644 dom/canvas/crashtests/1223740-1.html
 create mode 100644 dom/canvas/crashtests/1225381-1.html
 create mode 100644 dom/canvas/crashtests/1229932-1.html
 create mode 100644 dom/canvas/crashtests/1229983-1.html
 create mode 100644 dom/canvas/crashtests/1233613.html
 create mode 100644 dom/canvas/crashtests/1244850-1.html
 create mode 100644 dom/canvas/crashtests/1246775-1.html
 create mode 100644 dom/canvas/crashtests/1283113-1.html
 create mode 100644 dom/canvas/crashtests/1284356-1.html
 create mode 100644 dom/canvas/crashtests/1284578-1.html
 create mode 100644 dom/canvas/crashtests/1286458-1.html
 create mode 100644 dom/canvas/crashtests/1287515-1.html
 create mode 100644 dom/canvas/crashtests/1287652-1.html
 create mode 100644 dom/canvas/crashtests/1288872-1.html
 create mode 100644 dom/canvas/crashtests/1290628-1.html
 create mode 100644 dom/canvas/crashtests/1296410-1.html
 create mode 100644 dom/canvas/crashtests/1298576-1.html
 create mode 100644 dom/canvas/crashtests/1299062-1.html
 create mode 100644 dom/canvas/crashtests/1305085-1.html
 create mode 100644 dom/canvas/crashtests/1305312-1.html
 create mode 100644 dom/canvas/crashtests/1305850.html
 create mode 100644 dom/canvas/crashtests/1334366-1.html
 create mode 100644 dom/canvas/crashtests/1334647-1.html
 create mode 100644 dom/canvas/crashtests/1348976-1.html
 create mode 100644 dom/canvas/crashtests/1349067.html
 create mode 100644 dom/canvas/crashtests/1357092.html
 create mode 100644 dom/canvas/crashtests/1441613.html
 create mode 100644 dom/canvas/crashtests/1443671.html
 create mode 100644 dom/canvas/crashtests/1546390.html
 create mode 100644 dom/canvas/crashtests/1549853.html
 create mode 100644 dom/canvas/crashtests/1551745.html
 create mode 100644 dom/canvas/crashtests/1569648.html
 create mode 100644 dom/canvas/crashtests/1654477.html
 create mode 100644 dom/canvas/crashtests/1739454-1.html
 create mode 100644 dom/canvas/crashtests/1740031.html
 create mode 100644 dom/canvas/crashtests/1744172.html
 create mode 100644 dom/canvas/crashtests/1757755.html
 create mode 100644 dom/canvas/crashtests/1757925-1.html
 create mode 100644 dom/canvas/crashtests/1769878.html
 create mode 100644 dom/canvas/crashtests/1771007-1.html
 create mode 100644 dom/canvas/crashtests/1816140.html
 create mode 100644 dom/canvas/crashtests/1849704-1.html
 create mode 100644 dom/canvas/crashtests/1857986.html
 create mode 100644 dom/canvas/crashtests/1873790.html
 create mode 100644 dom/canvas/crashtests/360293-1.html
 create mode 100644 dom/canvas/crashtests/421715-1.html
 create mode 100644 dom/canvas/crashtests/553938-1.html
 create mode 100644 dom/canvas/crashtests/647480.html
 create mode 100644 dom/canvas/crashtests/727547.html
 create mode 100644 dom/canvas/crashtests/729116.html
 create mode 100644 dom/canvas/crashtests/743499-negative-size.html
 create mode 100644 dom/canvas/crashtests/745699-1.html
 create mode 100644 dom/canvas/crashtests/745818-large-source.html
 create mode 100644 dom/canvas/crashtests/746813-1.html
 create mode 100644 dom/canvas/crashtests/767337-1.html
 create mode 100644 dom/canvas/crashtests/779426.html
 create mode 100644 dom/canvas/crashtests/780392-1.html
 create mode 100644 dom/canvas/crashtests/789933-1.html
 create mode 100644 dom/canvas/crashtests/794463-1.html
 create mode 100644 dom/canvas/crashtests/802926-1.html
 create mode 100644 dom/canvas/crashtests/844280.html
 create mode 100644 dom/canvas/crashtests/896047-1.html
 create mode 100644 dom/canvas/crashtests/896047-2.html
 create mode 100644 dom/canvas/crashtests/916128-1.html
 create mode 100644 dom/canvas/crashtests/934939-1.html
 create mode 100644 dom/canvas/crashtests/989628.html
 create mode 100644 dom/canvas/crashtests/crashtests.list
 create mode 100644 dom/canvas/crashtests/texImage2D.html

(limited to 'dom/canvas/crashtests')

diff --git a/dom/canvas/crashtests/0px-size-font-667225.html b/dom/canvas/crashtests/0px-size-font-667225.html
new file mode 100644
index 0000000000..9de65f8f59
--- /dev/null
+++ b/dom/canvas/crashtests/0px-size-font-667225.html
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml" >
+<script language=javascript>
+
+function draw() {
+  var canv = document.getElementById("canv");
+  var ctx = canv.getContext("2d");
+
+  ctx.fillStyle = "red";
+  // 0 size font shouldn't crash!
+  ctx.font = "0px Arial";
+  ctx.fillText("A", 0, 0);
+  document.documentElement.className = "";
+}
+
+</script>
+<body onload="draw()">
+<canvas id="canv" width="5" height="5"></canvas>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/0px-size-font-shadow.html b/dom/canvas/crashtests/0px-size-font-shadow.html
new file mode 100644
index 0000000000..1298f3fa1e
--- /dev/null
+++ b/dom/canvas/crashtests/0px-size-font-shadow.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<body>
+<canvas id="canv" width="5" height="5"></canvas>
+<script>
+var canv = document.getElementById("canv");
+var ctx = canv.getContext("2d");
+
+ctx.fillStyle = "red";
+// 0 size font shouldn't assert!
+ctx.font = "0px Arial";
+ctx.shadowColor = '#f00';
+ctx.shadowBlur = 4;
+ctx.fillText("A", 0, 0);
+document.documentElement.className = "";
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/1099143-1.html b/dom/canvas/crashtests/1099143-1.html
new file mode 100644
index 0000000000..30bb3a0033
--- /dev/null
+++ b/dom/canvas/crashtests/1099143-1.html
@@ -0,0 +1,5 @@
+<script>
+  var canvas = document.createElement("canvas");
+  var context = canvas.getContext("2d");
+  context.fillText("", 0, 0);
+</script>
diff --git a/dom/canvas/crashtests/1161277-1.html b/dom/canvas/crashtests/1161277-1.html
new file mode 100644
index 0000000000..3e04dc46da
--- /dev/null
+++ b/dom/canvas/crashtests/1161277-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+    var canvas = document.createElement('canvas');
+    var ctx = canvas.getContext('2d');
+    ctx.setTransform(0.2988847856952777, 26589683732.25, -562949953421312, 5, 4503599627370495, -2735897607.139075);
+    ctx.bezierCurveTo(-1023, -4611686018427388000, 4194303, -536870911, 45139.65058316886, 35184372088833);
+    ctx.setLineDash([1.2307692307692308]);
+    ctx.setTransform(0, 2097152, 0.0005128205128205128, 305943.4982061649, -49282.263290019946, 3);
+    ctx.clip("evenodd");
+    ctx.scale(-2.3882113703861325, -2);
+    ctx.isPointInStroke(2, 86124313031369.77);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/1183363.html b/dom/canvas/crashtests/1183363.html
new file mode 100644
index 0000000000..2044a80928
--- /dev/null
+++ b/dom/canvas/crashtests/1183363.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+    var ctx = canvas.getContext('2d');
+    ctx.rect(2, 6, 9, 8);
+    ctx.setTransform(1, 2, 3, 0, 4, 1);
+    setTimeout(function() {
+        ctx.moveTo(0, 1);
+        ctx.isPointInPath(0, 0, 'evenodd');
+    }, 0);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<canvas id="canvas"></canvas>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/1190705.html b/dom/canvas/crashtests/1190705.html
new file mode 100644
index 0000000000..64795decb6
--- /dev/null
+++ b/dom/canvas/crashtests/1190705.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+    var canvas = document.createElement('canvas');
+    var ctx = canvas.getContext('2d');
+    ctx.rotate(1e308);
+    ctx.fillText("A", 1, 1);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/1223740-1.html b/dom/canvas/crashtests/1223740-1.html
new file mode 100644
index 0000000000..d5d9696935
--- /dev/null
+++ b/dom/canvas/crashtests/1223740-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom() {
+    var canvas = document.createElement('canvas');
+    var ctx = canvas.getContext('2d');
+    ctx.shadowColor = "green";
+    ctx.rotate(0.9923);
+    ctx.transform(6, 0.13807760834183488, 256, -0.39007851257689263, 0.5767177072299453, 64);
+    ctx.transform(0.61, 0.08697788582345888, 6, 6, 64, 128);
+    ctx.scale(0.36690500480283633, 6);
+    ctx.shadowOffsetY = -1.7976931348623157e+308;
+    ctx.fillText("A",32,0.848476537933684);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/1225381-1.html b/dom/canvas/crashtests/1225381-1.html
new file mode 100644
index 0000000000..5d76be9fae
--- /dev/null
+++ b/dom/canvas/crashtests/1225381-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom() {
+    var canvas = document.createElement('canvas');
+    var ctx = canvas.getContext('2d');
+    ctx.setTransform(new DOMMatrix([32, -1, 0.8320478957221024, 1.7976931348623157e+308, 512, 0.9012573524148337]).invertSelf());
+    ctx.fillText("A", 0 ,0);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/1229932-1.html b/dom/canvas/crashtests/1229932-1.html
new file mode 100644
index 0000000000..b5f06ff85c
--- /dev/null
+++ b/dom/canvas/crashtests/1229932-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom() {
+    var canvas = document.createElement('canvas');
+    var ctx = canvas.getContext('2d');
+    ctx.fillText("A", 0, 1e308);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/1229983-1.html b/dom/canvas/crashtests/1229983-1.html
new file mode 100644
index 0000000000..a865c569e4
--- /dev/null
+++ b/dom/canvas/crashtests/1229983-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom() {
+    var canvas = document.createElement('canvas');
+    var ctx = canvas.getContext('2d');
+    ctx.lineJoin = 'round';
+    ctx.transform(18.5, 41.6, 447, 78.2, 85.75, 120.5);
+    ctx.transform(186.25, 26.142857142857142, 251.5, -562949953421311, 147, 4.625);
+    ctx.rotate(32);
+    ctx.arc(33.8, 1, 183, 141.5, 452.5, 0);
+    ctx.transform(423, 24.75, 78, 12, 180.25, 191.5);
+    ctx.shadowBlur = 31.5;
+    ctx.shadowColor = "blue";
+    ctx.stroke();
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/1233613.html b/dom/canvas/crashtests/1233613.html
new file mode 100644
index 0000000000..d949c3b21c
--- /dev/null
+++ b/dom/canvas/crashtests/1233613.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<iframe style="display:none" srcdoc="
+
+<html>
+<head>
+<script type='text/javascript'>
+function boom() {
+    var gl = canvas.getContext('experimental-webgl');
+    video.srcObject = canvas.captureStream(0);
+}
+</script>
+</head>
+<body onload='boom();'>
+    <video id='video' width='256' height='256'></video>
+    <canvas id='canvas' width='256' height='256'></canvas>
+</body>
+</html>
+
+"></iframe>
diff --git a/dom/canvas/crashtests/1244850-1.html b/dom/canvas/crashtests/1244850-1.html
new file mode 100644
index 0000000000..015baf2c03
--- /dev/null
+++ b/dom/canvas/crashtests/1244850-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+    var canvas = document.createElement('canvas');
+    var ctx = canvas.getContext('2d');
+    var svgImage = document.getElementsByTagName("img")[0];
+    ctx.drawImage(svgImage, 1e+308, 0);
+}
+
+</script>
+</head>
+<body onload="boom();">
+
+<img src="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' width='100' height='100'><rect width='100' height='100' fill='blue'/></svg>">
+
+</body>
+</html>
diff --git a/dom/canvas/crashtests/1246775-1.html b/dom/canvas/crashtests/1246775-1.html
new file mode 100644
index 0000000000..8c4ddabdf8
--- /dev/null
+++ b/dom/canvas/crashtests/1246775-1.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+<script>
+function boom()
+{
+  var canvas = document.getElementById("canvas");
+  var ctx = SpecialPowers.wrap(canvas.getContext("2d"));
+  ctx.drawWindow(window, 0, 0, canvas.width, canvas.height, "red");
+}
+</script>
+</head>
+<body onload="boom();">
+<canvas id="canvas" width="10" height="10"></canvas>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/1283113-1.html b/dom/canvas/crashtests/1283113-1.html
new file mode 100644
index 0000000000..50234169be
--- /dev/null
+++ b/dom/canvas/crashtests/1283113-1.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+    var canvas = document.createElement('canvas');
+    var ctx = canvas.getContext('2d');
+    ctx.transform(1,1,0,0,0,0);
+    ctx.scale(610.561277214,0.0);
+    ctx.scale(442.538892637,64.9064087241);
+    ctx.scale(851.176724189,322.349092655);
+    ctx.scale(862.937434575,2.88757032711);
+    ctx.scale(230.933492526,766.024348731);
+    ctx.scale(968.538114712,4.580);
+    ctx.transform(1,0,1,0,1,0);
+    ctx.scale(341.640607159,753.362567174);
+    ctx.measureText('');
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/1284356-1.html b/dom/canvas/crashtests/1284356-1.html
new file mode 100644
index 0000000000..bbdb135b0e
--- /dev/null
+++ b/dom/canvas/crashtests/1284356-1.html
@@ -0,0 +1,9 @@
+<canvas id='i0'></canvas>
+<script>
+var c=document.getElementById('i0').getContext('2d');
+c.lineWidth=194.622602174;
+c.miterLimit=270.273509738;
+c.transform(0,0,0,0,0,0);
+c.globalCompositeOperation='soft-light';
+c.strokeText('a',200,273,722);
+</script>
\ No newline at end of file
diff --git a/dom/canvas/crashtests/1284578-1.html b/dom/canvas/crashtests/1284578-1.html
new file mode 100644
index 0000000000..ba6e5f9630
--- /dev/null
+++ b/dom/canvas/crashtests/1284578-1.html
@@ -0,0 +1,8 @@
+<canvas id='i0'></canvas>
+<script>
+var c=document.getElementById('i0').getContext('2d');
+c.bezierCurveTo(157,351,351,44,946,701);
+c.quadraticCurveTo(260,-9007199254740991,945,145);
+c.translate(-9007199254740991,239);
+c.isPointInPath(988,439);
+</script>
\ No newline at end of file
diff --git a/dom/canvas/crashtests/1286458-1.html b/dom/canvas/crashtests/1286458-1.html
new file mode 100644
index 0000000000..1241a5f0ed
--- /dev/null
+++ b/dom/canvas/crashtests/1286458-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+    var canvas = document.createElement('canvas');
+    var ctx = canvas.getContext('2d');
+    var path=new Path2D();
+    path.bezierCurveTo(436,Number.MIN_VALUE,620,Number.MAX_SAFE_INTEGER,1,83);
+    ctx.setTransform(1,Number.MAX_SAFE_INTEGER,1,0,1,146.0);
+    ctx.scale(16777218,55);
+    ctx.stroke(path);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/1287515-1.html b/dom/canvas/crashtests/1287515-1.html
new file mode 100644
index 0000000000..37dc8a2a0a
--- /dev/null
+++ b/dom/canvas/crashtests/1287515-1.html
@@ -0,0 +1,7 @@
+<canvas id='i0'></canvas>
+<script>
+var c=document.getElementById('i0').getContext('2d');
+c.lineWidth=Number.MAX_SAFE_INTEGER;
+c.setLineDash([1]);
+c.strokeRect(1,1,0,Number.MIN_SAFE_INTEGER);
+</script>
diff --git a/dom/canvas/crashtests/1287652-1.html b/dom/canvas/crashtests/1287652-1.html
new file mode 100644
index 0000000000..7eaccd58a3
--- /dev/null
+++ b/dom/canvas/crashtests/1287652-1.html
@@ -0,0 +1,8 @@
+<canvas id='i0'></canvas>
+<script>
+var c=document.getElementById('i0').getContext('2d');
+var g=c.createLinearGradient(59,9,38.89,-75.51);
+c.fillStyle=g;
+c.globalAlpha=0.62;
+c.fillText('a',0,24,30);
+</script>
diff --git a/dom/canvas/crashtests/1288872-1.html b/dom/canvas/crashtests/1288872-1.html
new file mode 100644
index 0000000000..de57311a55
--- /dev/null
+++ b/dom/canvas/crashtests/1288872-1.html
@@ -0,0 +1,6 @@
+<canvas id='id0'></canvas>
+<script>
+var c=document.getElementById('id0').getContext('2d');
+c.transform(1,0,1,0,0,0);
+c.fillText('A',0,53);
+</script>
\ No newline at end of file
diff --git a/dom/canvas/crashtests/1290628-1.html b/dom/canvas/crashtests/1290628-1.html
new file mode 100644
index 0000000000..a2502f70af
--- /dev/null
+++ b/dom/canvas/crashtests/1290628-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<body id='test_body'>
+<canvas id='i0'></canvas>
+<script>
+var c=document.getElementById('i0').getContext('2d');
+c.shadowOffsetX=73;
+c.scale(5,55);
+c.setLineDash([48,81,88,41,32767,8]);
+c.shadowColor='hsl(1.0,1%,1%)';
+c.miterLimit=Number.MIN_VALUE;
+c.strokeRect(0,58,8589934591,0);
+</script>
\ No newline at end of file
diff --git a/dom/canvas/crashtests/1296410-1.html b/dom/canvas/crashtests/1296410-1.html
new file mode 100644
index 0000000000..a282d4e0fd
--- /dev/null
+++ b/dom/canvas/crashtests/1296410-1.html
@@ -0,0 +1,9 @@
+<canvas id='canv'></canvas>
+<script>
+var ctx=document.getElementById('canv').getContext('2d');
+ctx.globalAlpha=0.81;
+ctx.scale(22,3406781);
+ctx.filter='sepia(80%)';
+ctx.font='52px serif';
+ctx.measureText('A');
+</script>
diff --git a/dom/canvas/crashtests/1298576-1.html b/dom/canvas/crashtests/1298576-1.html
new file mode 100644
index 0000000000..b3936027eb
--- /dev/null
+++ b/dom/canvas/crashtests/1298576-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script id="fshader" type="x-shader/x-fragment">
+void main() {
+  -2147483648 % 0xffffffff;
+  gl_FragColor = vec4(0.5, 0.5, 1.0, 1.0);
+}
+</script>
+</head>
+<body>
+<script>
+var gl = document.createElement('canvas').getContext('webgl');
+var program = gl.createProgram();
+var fshader = gl.createShader(gl.FRAGMENT_SHADER);
+var fshaderSource = document.getElementById("fshader").text;
+gl.shaderSource(fshader, fshaderSource);
+gl.compileShader(fshader);
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/1299062-1.html b/dom/canvas/crashtests/1299062-1.html
new file mode 100644
index 0000000000..2f33b889ad
--- /dev/null
+++ b/dom/canvas/crashtests/1299062-1.html
@@ -0,0 +1,5 @@
+<canvas id='id0' width='35376.4661501'></canvas>
+<script>
+var ctx=document.getElementById('id0').getContext('2d');
+ctx.getImageData(66,-1,32,87);
+</script>
diff --git a/dom/canvas/crashtests/1305085-1.html b/dom/canvas/crashtests/1305085-1.html
new file mode 100644
index 0000000000..017d10eb1b
--- /dev/null
+++ b/dom/canvas/crashtests/1305085-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<script>
+var c = document.createElementNS('http://www.w3.org/1999/xhtml', 'canvas');
+var cx = c.getContext('2d');
+cx.setTransform(1, 2, 2, 4, 0.41577222277777554, 0.89);
+cx.fillText("AA",2048,4);
+</script>
+</html>
diff --git a/dom/canvas/crashtests/1305312-1.html b/dom/canvas/crashtests/1305312-1.html
new file mode 100644
index 0000000000..3bd0b8c004
--- /dev/null
+++ b/dom/canvas/crashtests/1305312-1.html
@@ -0,0 +1,5 @@
+<canvas id='cid'></canvas>
+<script>
+var x=document.getElementById('cid').getContext('2d',{alpha: false});
+x.putImageData(x.createImageData(250,27434.63),Number.MAX_SAFE_INTEGER,23);
+</script>
\ No newline at end of file
diff --git a/dom/canvas/crashtests/1305850.html b/dom/canvas/crashtests/1305850.html
new file mode 100644
index 0000000000..7f79905161
--- /dev/null
+++ b/dom/canvas/crashtests/1305850.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<script>
+window.onload=function(){
+  var gl = document.createElementNS("http://www.w3.org/1999/xhtml", "canvas").getContext("webgl");
+  var shader = gl.createShader(gl.FRAGMENT_SHADER);
+  gl.shaderSource(shader, 'void main(){d[vec4[]()}');
+  gl.compileShader(shader);
+};
+</script>
+</html>
diff --git a/dom/canvas/crashtests/1334366-1.html b/dom/canvas/crashtests/1334366-1.html
new file mode 100644
index 0000000000..0b7bc65d9d
--- /dev/null
+++ b/dom/canvas/crashtests/1334366-1.html
@@ -0,0 +1,8 @@
+<script>
+Logger={}; Logger.JSError=function(e){};
+try { o0 = document.createElement('canvas'); } catch(e) { Logger.JSError(e); }
+try { (document.body || document.documentElement).appendChild(o0) } catch(e) { Logger.JSError(e); }
+try { o1 = o0.getContext('2d'); } catch(e) { Logger.JSError(e); }
+try { o1.translate(1152921504606847000, 0.919677262874245) } catch(e) { Logger.JSError(e); }
+try { o1.fillText("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",0.6494016751296356,-16,0.5988693960474034) } catch(e) { Logger.JSError(e); }
+</script>
diff --git a/dom/canvas/crashtests/1334647-1.html b/dom/canvas/crashtests/1334647-1.html
new file mode 100644
index 0000000000..b4510afebb
--- /dev/null
+++ b/dom/canvas/crashtests/1334647-1.html
@@ -0,0 +1,8 @@
+<script>
+Logger={}; Logger.JSError=function(e){};
+try { o0 = document.createElement('canvas'); } catch(e) { Logger.JSError(e); }
+try { (document.body || document.documentElement).appendChild(o0) } catch(e) { Logger.JSError(e); }
+try { o1 = o0.getContext('2d'); } catch(e) { Logger.JSError(e); }
+try { o0.width = 311853383.455201; } catch(e) { Logger.JSError(e); }
+try { o1.drawImage(o0, -0.906275445340731, 0.3679144809413502, 2, 32) } catch(e) { Logger.JSError(e); }
+</script>
diff --git a/dom/canvas/crashtests/1348976-1.html b/dom/canvas/crashtests/1348976-1.html
new file mode 100644
index 0000000000..655aec1a73
--- /dev/null
+++ b/dom/canvas/crashtests/1348976-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+function boom(){
+  let c = new OffscreenCanvas(0, 0);
+  c.transferToImageBitmap();
+}
+addEventListener("DOMContentLoaded", boom);
+</script>
+</head>
+</html>
diff --git a/dom/canvas/crashtests/1349067.html b/dom/canvas/crashtests/1349067.html
new file mode 100644
index 0000000000..f8c8e0da1e
--- /dev/null
+++ b/dom/canvas/crashtests/1349067.html
@@ -0,0 +1,10 @@
+<script>
+o0 = document.createElement('canvas');
+document.documentElement.appendChild(o0)
+o2 = o0.getContext("webgl2", {"premultipliedAlpha":false,"preserveDrawingBuffer":false,"depth":false})
+o12 = document.createElement('canvas');
+(document.body || document.documentElement).appendChild(o12)
+o13 = o12.getContext('2d');
+o14 = o13.getImageData(0.4002597041894355, 128, 8, 0.6125768461759614)
+o2.readBuffer(1029)
+</script>
diff --git a/dom/canvas/crashtests/1357092.html b/dom/canvas/crashtests/1357092.html
new file mode 100644
index 0000000000..110aa7e86e
--- /dev/null
+++ b/dom/canvas/crashtests/1357092.html
@@ -0,0 +1,10 @@
+<html>
+    <head>
+        <script>
+            o1 = document.createElement("canvas");
+            o1.setAttribute("width", "100000");
+            o2 = o1.getContext("2d");
+            o2.bezierCurveTo(64, 1, 1, 1, 1, 1);
+        </script>
+    </head>
+</html>
diff --git a/dom/canvas/crashtests/1441613.html b/dom/canvas/crashtests/1441613.html
new file mode 100644
index 0000000000..c6ca8f3492
--- /dev/null
+++ b/dom/canvas/crashtests/1441613.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<iframe id="iframe" src="about:blank"></iframe>
+<script>
+iframe.onload = function() {
+  let doc = iframe.contentDocument;
+  let canvas = doc.createElement('canvas');
+  doc.body.appendChild(canvas);
+  let ctx = canvas.getContext('2d');
+  document.body.offsetTop;
+  iframe.style.display = 'none';
+  try {
+    ctx.font = '10px serif';
+  } finally {
+    document.documentElement.className = "";
+  }
+};
+</script>
+</html>
diff --git a/dom/canvas/crashtests/1443671.html b/dom/canvas/crashtests/1443671.html
new file mode 100644
index 0000000000..28a2fcd0a8
--- /dev/null
+++ b/dom/canvas/crashtests/1443671.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<script>
+try { o1 = document.createElement('canvas') } catch (e) {}
+try { o2 = o1.transferControlToOffscreen() } catch (e) {}
+try { o2.getContext("webgl", { }) } catch (e) {}
+</script>
+</html>
diff --git a/dom/canvas/crashtests/1546390.html b/dom/canvas/crashtests/1546390.html
new file mode 100644
index 0000000000..b44eb8ea47
--- /dev/null
+++ b/dom/canvas/crashtests/1546390.html
@@ -0,0 +1,11 @@
+<html>
+<head>
+    <script>
+      function start () {
+        new OffscreenCanvas(1, 127).toBlob()
+      }
+
+      window.addEventListener('load', start)
+    </script>
+</head>
+</html>
diff --git a/dom/canvas/crashtests/1549853.html b/dom/canvas/crashtests/1549853.html
new file mode 100644
index 0000000000..532430e386
--- /dev/null
+++ b/dom/canvas/crashtests/1549853.html
@@ -0,0 +1,8 @@
+<canvas id='a' height='67108864' width='80'></canvas>
+<script>
+document.addEventListener("DOMContentLoaded", function() {
+  var c=document.getElementById('a')
+  var x=c.getContext('2d', {alpha: true})
+  c.setAttribute('width', 800)
+})
+</script>
diff --git a/dom/canvas/crashtests/1551745.html b/dom/canvas/crashtests/1551745.html
new file mode 100644
index 0000000000..f7617b96ef
--- /dev/null
+++ b/dom/canvas/crashtests/1551745.html
@@ -0,0 +1,9 @@
+<script>
+window.addEventListener('load', function() {
+  b.getContext('2d')
+  a.src = b.toDataURL('image/jpeg', 0.1)
+  b.setAttribute('width', 2684354)
+})
+</script>
+<img id='a' src='data:image/gif;base64,R0lGODlhAQABAIABAP///wAAACwAAAAAAQABAAACAkQBADs='/>
+<canvas id='b' height='800' width='800'></canvas>
diff --git a/dom/canvas/crashtests/1569648.html b/dom/canvas/crashtests/1569648.html
new file mode 100644
index 0000000000..766d9fa937
--- /dev/null
+++ b/dom/canvas/crashtests/1569648.html
@@ -0,0 +1,5 @@
+<!doctype html>
+<base href="a:">
+<script>
+  document.createElement("canvas").getContext("2d").filter = "url()";
+</script>
diff --git a/dom/canvas/crashtests/1654477.html b/dom/canvas/crashtests/1654477.html
new file mode 100644
index 0000000000..5303291fe2
--- /dev/null
+++ b/dom/canvas/crashtests/1654477.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  const canvas = document.getElementById('canvas');
+  const ctx = canvas.getContext('2d');
+
+  for (let i = 0; i < 50; i++) {
+    canvas.width = 20;
+    ctx.fillStyle = 'green';
+    ctx.fillRect(1, 1, 20, 20);
+    canvas.width = 10;
+    ctx.fillStyle = 'green';
+    ctx.fillRect(1, 1, 10, 10);
+  }
+}
+
+</script>
+</head>
+<body onload="boom();">
+<canvas id="canvas"></canvas>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/1739454-1.html b/dom/canvas/crashtests/1739454-1.html
new file mode 100644
index 0000000000..a32445249d
--- /dev/null
+++ b/dom/canvas/crashtests/1739454-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+document.addEventListener('DOMContentLoaded', async () => {
+  cnv = document.createElement('canvas')
+  ctx = cnv.getContext('2d')
+  try {
+    a = await fetch('');
+    b = await a.arrayBuffer();
+    c = await self.createImageBitmap(new Blob([b]), {'premultiplyAlpha':'none'})
+    ctx.createPattern(c, 'repeat-x')
+  } finally {
+    document.documentElement.className = "";
+  }
+})
+</script>
+</html>
diff --git a/dom/canvas/crashtests/1740031.html b/dom/canvas/crashtests/1740031.html
new file mode 100644
index 0000000000..fb5d11b3fd
--- /dev/null
+++ b/dom/canvas/crashtests/1740031.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <script>
+      document.addEventListener('DOMContentLoaded', () => {
+        const canvas = document.createElementNS('http://www.w3.org/1999/xhtml', 'canvas')
+        const context = canvas.getContext('webgl')
+        window.createImageBitmap(canvas, 81, 253, 1754696613, 348508165)
+      })
+    </script>
+</head>
+</html>
diff --git a/dom/canvas/crashtests/1744172.html b/dom/canvas/crashtests/1744172.html
new file mode 100644
index 0000000000..0fd6313bba
--- /dev/null
+++ b/dom/canvas/crashtests/1744172.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+
+document.addEventListener('DOMContentLoaded', () => {
+  const gl = document.createElement('canvas').getContext('webgl');
+  const a = gl.getExtension('EXT_disjoint_timer_query');
+  const b = a.createQueryEXT();
+  a.queryCounterEXT(b, a.TIMESTAMP_EXT);
+  a.deleteQueryEXT(b);
+});
+
+</script>
+</head>
+</html>
diff --git a/dom/canvas/crashtests/1757755.html b/dom/canvas/crashtests/1757755.html
new file mode 100644
index 0000000000..4e222f79cd
--- /dev/null
+++ b/dom/canvas/crashtests/1757755.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+
+window.addEventListener("load", () => {
+  const canvas = document.createElement('canvas');
+  const context = canvas.getContext("webgl");
+  const extension = context.getExtension("WEBGL_lose_context");
+  extension.loseContext();
+  extension.restoreContext();
+  canvas.height = 0;
+});
+
+</script>
+</head>
+</html>
diff --git a/dom/canvas/crashtests/1757925-1.html b/dom/canvas/crashtests/1757925-1.html
new file mode 100644
index 0000000000..c42ab9c876
--- /dev/null
+++ b/dom/canvas/crashtests/1757925-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+    window.addEventListener("load", () => {
+      const canvas = document.createElement("canvas")
+      const context = canvas.getContext("2d")
+      context.shadowColor = "#cad1"
+      context.setTransform({ "b": 2.144923254600512e+37 })
+      context.shadowOffsetY = -128
+      context.drawImage(canvas, 16, 255, 128, -128)
+    })
+  </script>
+</head>
+</html>
\ No newline at end of file
diff --git a/dom/canvas/crashtests/1769878.html b/dom/canvas/crashtests/1769878.html
new file mode 100644
index 0000000000..1646f71793
--- /dev/null
+++ b/dom/canvas/crashtests/1769878.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<script id="w1">
+    self.onmessage = async () => {
+      try { self.close() } catch (e) {}
+      let a = new OffscreenCanvas(143, 178)
+      a.convertToBlob({ })
+    }
+    </script>
+<script>
+    window.addEventListener('load', async () => {
+      const blob = new Blob([document.querySelector('#w1').textContent], { type: "text/javascript" })
+      const worker = new Worker(window.URL.createObjectURL(blob))
+      worker.postMessage([], [])
+    })
+</script>
diff --git a/dom/canvas/crashtests/1771007-1.html b/dom/canvas/crashtests/1771007-1.html
new file mode 100644
index 0000000000..1e5642e3ad
--- /dev/null
+++ b/dom/canvas/crashtests/1771007-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <script id="worker1" type="javascript/worker">
+      self.onmessage = async function (e) {
+        const canvas = new OffscreenCanvas(82, 127)
+        canvas.getContext('2d', {})
+        canvas.width = 134
+        await canvas.convertToBlob({})
+        canvas.transferToImageBitmap()
+      }
+    </script>
+    <script>
+      window.addEventListener('load', () => {
+        const blob = new Blob([document.querySelector('#worker1').textContent], { type: 'text/javascript' })
+        const worker = new Worker(window.URL.createObjectURL(blob))
+        worker.postMessage([], [])
+        setTimeout('self.close()', 500)
+      })
+    </script>
+</head>
+</html>
\ No newline at end of file
diff --git a/dom/canvas/crashtests/1816140.html b/dom/canvas/crashtests/1816140.html
new file mode 100644
index 0000000000..3fe55cef62
--- /dev/null
+++ b/dom/canvas/crashtests/1816140.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <script>
+      window.addEventListener("load", async () => {
+        const adapter = await navigator.gpu.requestAdapter({})
+        const device = await adapter.requestDevice({})
+        const canvas = new OffscreenCanvas(184, 4266759736)
+        context = canvas.getContext('webgpu')
+        context.configure({
+          device: device,
+          format: context.getPreferredFormat(adapter),
+        })
+      })
+    </script>
+</head>
+</html>
\ No newline at end of file
diff --git a/dom/canvas/crashtests/1849704-1.html b/dom/canvas/crashtests/1849704-1.html
new file mode 100644
index 0000000000..18e0311a85
--- /dev/null
+++ b/dom/canvas/crashtests/1849704-1.html
@@ -0,0 +1,36 @@
+
+<!DOCTYPE html>
+<html>
+
+<head>
+  <meta charset="utf-8">
+  <title>TransferToImageBitmap</title>
+</head>
+
+<body>
+  <div id="description"></div>
+  <div id="console"></div>
+  <script id='myWorker' type='text/worker'>
+  self.onmessage = function(e) {
+      var canvas = new OffscreenCanvas(128, 128);
+      var gl = canvas.getContext("webgl2");
+      gl.clearColor(1.0, 1.0, 0.0, 1.0);
+      gl.clear(gl.COLOR_BUFFER_BIT);
+      var image = canvas.transferToImageBitmap();
+
+      self.postMessage({ bitmap: image },
+                       [ image ]);
+  };
+  </script>
+  <script>
+    var blob = new Blob([document.getElementById('myWorker').textContent]);
+    var worker = new Worker(URL.createObjectURL(blob));
+    worker.onmessage = function (msg) {
+      try { worker.postMessage('Start worker'); } catch (e) { }
+    };
+
+    try { worker.postMessage('Start worker'); } catch (e) { }
+  </script>
+</body>
+
+</html>
\ No newline at end of file
diff --git a/dom/canvas/crashtests/1857986.html b/dom/canvas/crashtests/1857986.html
new file mode 100644
index 0000000000..0cdbde9640
--- /dev/null
+++ b/dom/canvas/crashtests/1857986.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<script>
+  window.addEventListener('load', async () => {
+    const svg = document.createElementNS('http://www.w3.org/2000/svg', 'svg')
+    const filter = document.createElementNS('http://www.w3.org/2000/svg', 'filter')
+    filter.setAttribute('id', 'id_14')
+    const feColorMatrix = document.createElementNS('http://www.w3.org/2000/svg', 'feColorMatrix')
+    feColorMatrix.setAttribute('width', '-1938067758ch')
+    filter.appendChild(feColorMatrix)
+    svg.appendChild(filter)
+    document.documentElement.appendChild(svg)
+    const canvas = document.createElementNS('http://www.w3.org/1999/xhtml', 'canvas')
+    const context = canvas.getContext('2d')
+    context.filter = 'url(#id_14) url(#id_14) contrast(1491560509%) saturate(859756593%) url(#id_14)'
+  })
+</script>
diff --git a/dom/canvas/crashtests/1873790.html b/dom/canvas/crashtests/1873790.html
new file mode 100644
index 0000000000..4404d22121
--- /dev/null
+++ b/dom/canvas/crashtests/1873790.html
@@ -0,0 +1,9 @@
+<script>
+document.addEventListener("DOMContentLoaded", async () => {
+  let a = document.createElementNS("http://www.w3.org/1999/xhtml", "canvas")
+  let bmp = await self.createImageBitmap(a.getContext("2d"), 100, -187, -214, 57, { })
+  let chan = new MessageChannel()
+  const worker = new Worker("none", { })
+  worker.postMessage([bmp, chan.port1], [bmp, chan.port1])
+})
+</script>
diff --git a/dom/canvas/crashtests/360293-1.html b/dom/canvas/crashtests/360293-1.html
new file mode 100644
index 0000000000..8a0859e41b
--- /dev/null
+++ b/dom/canvas/crashtests/360293-1.html
@@ -0,0 +1,35 @@
+<html>
+
+
+<body>
+ Firefox: <a href="javascript:noCrash()">no crash</a> | <a href="javascript:crash()">crash</a><br/>
+ <canvas id="foo" width="200" height="200">
+ </canvas>
+ <script>
+   function d(lineWidth){
+    var c = document.getElementById("foo").getContext("2d")
+    c.clearRect(0,0,200,200)
+    c.lineWidth = lineWidth
+    c.beginPath()
+    c.arc(100,100,80, Math.PI, 2*Math.PI, 1)
+    c.stroke()
+    c.beginPath()
+    c.arc(50,50, 20, 0, 2*Math.PI, 1)
+    c.stroke()
+    c.beginPath()
+    c.arc(150,50, 20, 0, 2*Math.PI, 1)
+    c.stroke()
+   }
+   function noCrash() {
+     d(Math.random()*20+5)
+   }
+   function crash() {
+     d( '_' )
+   }
+
+   crash();
+ </script>
+
+</body>
+
+</html>
diff --git a/dom/canvas/crashtests/421715-1.html b/dom/canvas/crashtests/421715-1.html
new file mode 100644
index 0000000000..c2ea9b28ad
--- /dev/null
+++ b/dom/canvas/crashtests/421715-1.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <script type="text/javascript">
+      function stringify(a) {
+        if (a)
+          return a.toSource();
+        return ''+a;
+      }
+      var args = [undefined, null, [], {}, 0, "0"];
+      var stringArgs = args.map(stringify);
+
+      function test_method(context, method, arity) {
+        function testParams(existingParams, depth) {
+          for (var arg of stringArgs) {
+            var code = "context[method](" + existingParams + arg + ")";
+            try {
+              eval(code);
+            } catch (ex) {
+              // Exceptions are expected
+            }
+
+            if (depth < arity)
+              testParams(existingParams + arg + ",", depth + 1);
+          }
+        }
+        testParams("", 1);
+      }
+
+      function startTest() {
+        var canvas = document.getElementById("img");
+        var context = canvas.getContext('2d');;
+        test_method(context, "getImageData", 4);
+        test_method(context, "putImageData", 3);
+      }
+    </script>
+  </head>
+  <body onload="startTest()">
+    <canvas id="img">No canvas support.</canvas>
+  </body>
+</html>
diff --git a/dom/canvas/crashtests/553938-1.html b/dom/canvas/crashtests/553938-1.html
new file mode 100644
index 0000000000..97e6b6c8ab
--- /dev/null
+++ b/dom/canvas/crashtests/553938-1.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<html>
+  <head>
+    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
+    <title>ImageData Crash Test</title>
+  </head>
+  <body onload="crash();">
+    <canvas id="c" width="10" height="10"></canvas>
+    <script>
+      function crash() {
+        var canvas = document.getElementById('c');
+        var ctx = canvas.getContext('2d');
+        var imgData = {data: new Array(10*10*4), width: 10, height: 10};
+
+        imgData[0] = 0;
+        ctx.putImageData(imgData, 0, 0);
+      }
+    </script>
+  </body>
+</html>
diff --git a/dom/canvas/crashtests/647480.html b/dom/canvas/crashtests/647480.html
new file mode 100644
index 0000000000..2693207b15
--- /dev/null
+++ b/dom/canvas/crashtests/647480.html
@@ -0,0 +1,102 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var canvas = document.createElementNS("http://www.w3.org/1999/xhtml", "canvas");
+  var ctx = canvas.getContext("2d");
+  document.implementation.createDocument("", "", null).adoptNode(canvas);
+
+  try { ctx.save(); } catch(e){}
+  try { ctx.restore(); } catch(e){}
+  try { ctx.scale(0,0); } catch(e){}
+  try { ctx.rotate(90); } catch(e){}
+  try { ctx.translate(1,1); } catch(e){}
+  try { ctx.transform(0,100,200,300,10,10); } catch(e){}
+  try { ctx.setTransform(0,100,200,300,10,10); } catch(e){}
+
+  try { x = ctx.globalAlpha; } catch(e){}
+  try { ctx.globalAlpha = 0.8; } catch(e){}
+  try { x = ctx.globalCompositeOperation; } catch(e){}
+  try { ctx.globalCompositeOperation = "copy"; } catch(e){}
+  try { x = ctx.strokeStyle; } catch(e){}
+  try { ctx.strokeStyle = "red"; } catch(e){}
+  try { x = ctx.fillStyle; } catch(e){}
+  try { ctx.fillStyle = "red"; } catch(e){}
+
+  try { ctx.createLinearGradient(0,100,100,100); } catch(e){}
+  try { ctx.createRadialGradient(0,100,100,100,10,10); } catch(e){}
+  try { ctx.createPattern(document.getElementsByTagName('img')[0], "repeat"); } catch(e){}
+
+  try { x = ctx.lineWidth; } catch(e){}
+  try { ctx.lineWidth = 2; } catch(e){}
+  try { x = ctx.lineCap; } catch(e){}
+  try { ctx.lineCap = "round"; } catch(e){}
+  try { x = ctx.lineJoin; } catch(e){}
+  try { ctx.lineJoin = "bevel"; } catch(e){}
+  try { x = ctx.miterLimit; } catch(e){}
+  try { ctx.miterLimit = 12; } catch(e){}
+
+  try { x = ctx.shadowOffsetX; } catch(e){}
+  try { ctx.shadowOffsetX = 1; } catch(e){}
+  try { x = ctx.shadowOffsetY; } catch(e){}
+  try { ctx.shadowOffsetY = 1; } catch(e){}
+  try { x = ctx.shadowBlur; } catch(e){}
+  try { ctx.shadowBlur = 1; } catch(e){}
+  try { x = ctx.shadowColor; } catch(e){}
+  try { ctx.shadowColor = "red"; } catch(e){}
+
+  try { ctx.clearRect(0,0,100,100); } catch(e){}
+  try { ctx.fillRect(0,0,100,100); } catch(e){}
+  try { ctx.strokeRect(0,0,100,100); } catch(e){}
+
+  try { ctx.beginPath(); } catch(e){}
+  try { ctx.moveTo(1,1); } catch(e){}
+  try { ctx.lineTo(10,10); } catch(e){}
+  try { ctx.quadraticCurveTo(1,2,3,4); } catch(e){}
+  try { ctx.bezierCurveTo(1,2,3,4,5,6); } catch(e){}
+  try { ctx.arcTo(1,2,3,4,5); } catch(e){}
+  try { ctx.arc(1,2,3,4,5); } catch(e){}
+  try { ctx.arc(1,2,3,4,5,true); } catch(e){}
+  try { ctx.rect(1,2,3,4); } catch(e){}
+  try { ctx.closePath(); } catch(e){}
+
+  try { ctx.fill(); } catch(e){}
+  try { ctx.stroke(); } catch(e){}
+  try { ctx.clip(); } catch(e){}
+
+  try { x = ctx.font; } catch(e){}
+  try { ctx.font = "14px sans-serif"; } catch(e){}
+  try { x = ctx.textAlign; } catch(e){}
+  try { ctx.textAlign = "right"; } catch(e){}
+  try { x = ctx.textBaseline; } catch(e){}
+  try { ctx.textBaseline = "top"; } catch(e){}
+
+  try { ctx.fillText("",0,0); } catch(e){}
+  try { ctx.strokeText("",0,0); } catch(e){}
+  try { ctx.measureText(""); } catch(e){}
+
+  try { ctx.mozDrawText(""); } catch(e){}
+  try { ctx.mozPathText(""); } catch(e){}
+  try { ctx.mozTextAlongPath("",true); } catch(e){}
+  try { ctx.mozTextAlongPath("",false); } catch(e){}
+
+  try { ctx.drawImage(document.getElementsByTagName('img')[0], 0, 0); } catch(e){}
+  try { ctx.isPointInPath(0, 0); } catch(e){}
+  try { ctx.createImageData(); } catch(e){}
+  try { ctx.getImageData(); } catch(e){}
+  try { ctx.putImageData(); } catch(e){}
+
+  try { x = ctx.imageSmoothingEnabled;  } catch(e){}
+  try { ctx.imageSmoothingEnabled = false;  } catch(e){}
+  try { ctx.imageSmoothingEnabled = true;  } catch(e){}
+
+  try { ctx.drawWindow(window, 0, 0, 0, 0, "red"); } catch(e){}
+}
+
+</script>
+</head>
+<body onload="boom();"><img width="100" height="100" src="data:image/gif;base64,R0lGODlhAQABAIABAAD/AP///ywAAAAAAQABAAACAkQBADs="></body>
+</html>
diff --git a/dom/canvas/crashtests/727547.html b/dom/canvas/crashtests/727547.html
new file mode 100644
index 0000000000..005841de8a
--- /dev/null
+++ b/dom/canvas/crashtests/727547.html
@@ -0,0 +1,7 @@
+<!doctype html>
+<canvas></canvas>
+<script>
+var canvas = document.body.firstChild,
+    gl = canvas.getContext("experimental-webgl");
+gl.texImage2D(0, 0, 0, 0, 0, { width: 10, height: 10, data: 7 });
+</script>
diff --git a/dom/canvas/crashtests/729116.html b/dom/canvas/crashtests/729116.html
new file mode 100644
index 0000000000..679f9d2965
--- /dev/null
+++ b/dom/canvas/crashtests/729116.html
@@ -0,0 +1,18 @@
+<html>
+<script language=javascript>
+
+function draw() {
+  var canv = document.getElementById("canv");
+  var ctx = canv.getContext("2d");
+  try {
+    canv.width = 50000;
+  } catch (e) { }
+
+  ctx.clearRect(0, 0, 10, 10);
+}
+
+</script>
+<body onload="draw()">
+<canvas id="canv" width="5" height="5"></canvas>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/743499-negative-size.html b/dom/canvas/crashtests/743499-negative-size.html
new file mode 100644
index 0000000000..7cfcd55b2a
--- /dev/null
+++ b/dom/canvas/crashtests/743499-negative-size.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+    <title></title>
+    <script type="text/javascript">
+        function go() {
+        var canvas = document.createElement("canvas");
+        var ctx = canvas.getContext('2d');
+        ctx.globalAlpha = 4
+        ctx.lineCap = "foo"
+        ctx.strokeRect(256,1024,8,4)
+        ctx.shadowColor = "black"
+        ctx.shadowOffsetY = 64
+        ctx.stroke()
+        ctx.moveTo(32,1024)
+        ctx.closePath()
+        }
+    </script>
+</head>
+<body onload="go()">
+<canvas id="canvas"></canvas>
+</body>
+</html>
\ No newline at end of file
diff --git a/dom/canvas/crashtests/745699-1.html b/dom/canvas/crashtests/745699-1.html
new file mode 100644
index 0000000000..c65acf201a
--- /dev/null
+++ b/dom/canvas/crashtests/745699-1.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+@font-face {
+  font-family: "z";
+  src: url(invalid);
+}
+</style>
+
+<script>
+function boom()
+{
+  var ctx = document.querySelector("canvas").getContext('2d');
+  ctx.font = "10px serif";
+  document.querySelector("style").appendChild(document.createTextNode(" "));
+  ctx.measureText("123");
+}
+</script>
+</head>
+
+<body onload="boom();">
+<canvas width="100" height="100"></canvas>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/745818-large-source.html b/dom/canvas/crashtests/745818-large-source.html
new file mode 100644
index 0000000000..a5be76be06
--- /dev/null
+++ b/dom/canvas/crashtests/745818-large-source.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var a = document.getElementById("a");
+  var b = document.getElementById("b");
+  a.getContext('2d').createPattern(b, 'no-repeat');
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<canvas id="a" width="61" height="26"></canvas>
+<canvas id="b" width="611" height="439807"></canvas>
+</body>
+
+</html>
diff --git a/dom/canvas/crashtests/746813-1.html b/dom/canvas/crashtests/746813-1.html
new file mode 100644
index 0000000000..0e22e7f9d8
--- /dev/null
+++ b/dom/canvas/crashtests/746813-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.getElementById('c').getContext('2d').getTransform().invertSelf();">
+<canvas id="c" width="772" height="76441"></canvas>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/767337-1.html b/dom/canvas/crashtests/767337-1.html
new file mode 100644
index 0000000000..3c2c4ebd18
--- /dev/null
+++ b/dom/canvas/crashtests/767337-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<body>
+<canvas id="c" width="500" height="1000">
+</canvas>
+<script>
+var ctxt = document.getElementById('c').getContext('2d');
+for (var k = 0; k < 100; ++j) {
+  for (var j = 0; j < 10; ++j) {
+    for (var i = 0; i < 1000; ++i) {
+      gradient = ctxt.createLinearGradient(0,0,200,i);
+      gradient.addColorStop(0,'black');
+      gradient.addColorStop(1,'rgba(0, 255*k/100, 0, 0.1)');
+      ctxt.fillStyle = gradient;
+      ctxt.fillRect(j*50, 2*i, 50, 2);
+    }
+  }
+}
+</script>
+</body>
+</html>
\ No newline at end of file
diff --git a/dom/canvas/crashtests/779426.html b/dom/canvas/crashtests/779426.html
new file mode 100644
index 0000000000..ded3455b81
--- /dev/null
+++ b/dom/canvas/crashtests/779426.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var canvas = document.createElementNS('http://www.w3.org/1999/xhtml', 'canvas');
+  var canvas2d = canvas.getContext('2d');
+  canvas2d.rect(0, 0, 1, 1);
+  canvas2d.transform(1, 0, 0, 1, 0, 0);
+  canvas.setAttributeNS(null, "height", "99");
+  canvas2d.rect(0, 0, 1, 1);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/780392-1.html b/dom/canvas/crashtests/780392-1.html
new file mode 100644
index 0000000000..2112c9a759
--- /dev/null
+++ b/dom/canvas/crashtests/780392-1.html
@@ -0,0 +1,10 @@
+<!doctype HTML>
+<html>
+<body>
+<canvas id="c" width="10000" height="10000"></canvas>
+<script>
+var ctx = document.getElementById("c").getContext("2d");
+ctx.fillText("Hello world!", 50, 50);
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/789933-1.html b/dom/canvas/crashtests/789933-1.html
new file mode 100644
index 0000000000..a5f2f3437b
--- /dev/null
+++ b/dom/canvas/crashtests/789933-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<body>
+<canvas id="c" width="5000" height="20000">
+</canvas>
+<script>
+var ctxt = document.getElementById('c').getContext('2d');
+ctxt.strokeStyle = "Red";
+ctxt.font = "bold 16px Arial";
+ctxt.strokeText('Hello World!', 100, 100);
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/794463-1.html b/dom/canvas/crashtests/794463-1.html
new file mode 100644
index 0000000000..5726baa743
--- /dev/null
+++ b/dom/canvas/crashtests/794463-1.html
@@ -0,0 +1,17 @@
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+
+<!doctype HTML>
+<html>
+<body>
+<canvas id="c" width="100" height="100"></canvas>
+<script>
+var c = document.getElementById("c");
+var ctx = c.getContext("2d");
+var p = ctx.createPattern(c, "no-repeat");
+ctx.rect(0, 0, 100, 100);
+ctx.fillStyle = p;
+ctx.fill();
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/802926-1.html b/dom/canvas/crashtests/802926-1.html
new file mode 100644
index 0000000000..a42ca50c1b
--- /dev/null
+++ b/dom/canvas/crashtests/802926-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<script>
+
+document.createElement('canvas').toBlob(null);
+
+</script>
diff --git a/dom/canvas/crashtests/844280.html b/dom/canvas/crashtests/844280.html
new file mode 100644
index 0000000000..5d1e2dceab
--- /dev/null
+++ b/dom/canvas/crashtests/844280.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var canvas = document.createElement("canvas");
+  canvas.setAttribute("width", "7623");
+  canvas.setAttribute("height", "14064");
+  canvas.getContext("experimental-webgl");
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/896047-1.html b/dom/canvas/crashtests/896047-1.html
new file mode 100644
index 0000000000..2b121b2279
--- /dev/null
+++ b/dom/canvas/crashtests/896047-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<body>
+<canvas id="c" width="200" height="100">
+</canvas>
+<script>
+var ctx = document.getElementById("c").getContext("2d");
+ctx.save();
+ctx.save();
+ctx.rect(0,0, 1,1);
+ctx.restore();
+ctx.fill('evenodd');
+ctx.restore();
+ctx.lineTo(10, 0);
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/896047-2.html b/dom/canvas/crashtests/896047-2.html
new file mode 100644
index 0000000000..4cd12dfb48
--- /dev/null
+++ b/dom/canvas/crashtests/896047-2.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<body>
+<canvas id="c" width="200" height="100">
+</canvas>
+<script>
+var ctx = document.getElementById("c").getContext("2d");
+ctx.save();
+ctx.mozFillRule = 'nonzero';
+ctx.save();
+ctx.mozFillRule = 'evenodd';
+ctx.rect(0,0, 1,1);
+ctx.restore();
+ctx.isPointInPath(0,0);
+ctx.restore();
+ctx.lineTo(10, 0);
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/916128-1.html b/dom/canvas/crashtests/916128-1.html
new file mode 100644
index 0000000000..7981271e9c
--- /dev/null
+++ b/dom/canvas/crashtests/916128-1.html
@@ -0,0 +1,13 @@
+<script>
+o0 = document.createElement('canvas');
+(document.body || document.documentElement).appendChild(o0);
+o1 = o0.getContext('2d');
+o2 = document.createElement('img');
+//o2.src = "image2.png";
+o3 = o1.createImageData(0.7409945472006207, 0.8815588599260801);
+o1.save();
+o1.setTransform(0.18777365986904448, 4, 4, -2048, 3, 32);
+o0.width = 0.52;
+o1.putImageData(o3, -32, -0.16596290333335356);
+o0.toBlob(function() {}, "video/mp4", 16);
+</script>
diff --git a/dom/canvas/crashtests/934939-1.html b/dom/canvas/crashtests/934939-1.html
new file mode 100644
index 0000000000..d2ffbf4755
--- /dev/null
+++ b/dom/canvas/crashtests/934939-1.html
@@ -0,0 +1,8 @@
+<script type="text/javascript">
+  function run() {
+    var cx = canvas.getContext("2d");
+    canvas.toDataURL("image/png");
+  }
+</script>
+<body onload="run()">
+<canvas width="1" height="65536" id="canvas"></canvas>
diff --git a/dom/canvas/crashtests/989628.html b/dom/canvas/crashtests/989628.html
new file mode 100644
index 0000000000..99735a947a
--- /dev/null
+++ b/dom/canvas/crashtests/989628.html
@@ -0,0 +1,9 @@
+<script>
+o0 = document.createElement('canvas');
+o1 = o0.getContext('2d');
+o3 = o1.createImageData(32, 0.696);
+o1.arc(128, 0.37, 256, 4, 0.070, true);
+o1.moveTo(-2, 0.973);
+o1.clip('evenodd');
+o1.strokeText("A",0.610,-0.335,0.817);
+</script>
diff --git a/dom/canvas/crashtests/crashtests.list b/dom/canvas/crashtests/crashtests.list
new file mode 100644
index 0000000000..2cd7177b77
--- /dev/null
+++ b/dom/canvas/crashtests/crashtests.list
@@ -0,0 +1,70 @@
+load 0px-size-font-667225.html
+load 0px-size-font-shadow.html
+load 360293-1.html
+load 421715-1.html
+load 553938-1.html
+load 647480.html
+skip-if(Android&&browserIsRemote) load 727547.html # bug 1507207
+load 729116.html
+load 745699-1.html
+load 746813-1.html
+load 743499-negative-size.html
+load 745818-large-source.html
+load 767337-1.html
+load 779426.html
+skip-if(ThreadSanitizer) load 780392-1.html
+skip-if(ThreadSanitizer) skip-if(gtkWidget&&isDebugBuild) skip-if(winWidget&&(!is64Bit)) load 789933-1.html # bug 1155252 for linux
+skip-if(ThreadSanitizer) load 794463-1.html
+skip-if(ThreadSanitizer) load 802926-1.html
+skip-if(wayland) skip-if(ThreadSanitizer) load 844280.html # wayland: bug 1856365, intermittent OOMs on Win7 debug
+load 896047-1.html
+load 916128-1.html
+load 934939-1.html
+load 989628.html
+load 1099143-1.html
+load 1161277-1.html
+load 1183363.html
+load 1190705.html
+load 1223740-1.html
+load 1225381-1.html
+skip-if(azureCairo) load 1229983-1.html
+load 1229932-1.html
+load 1244850-1.html
+load 1246775-1.html
+load 1284356-1.html
+load 1284578-1.html
+skip-if(d2d) load 1287515-1.html
+load 1287652-1.html
+load 1288872-1.html
+load 1290628-1.html
+load 1283113-1.html
+load 1286458-1.html
+load 1296410-1.html
+load 1298576-1.html
+load 1299062-1.html
+load 1305085-1.html
+load 1305312-1.html
+load 1305850.html
+load 1334366-1.html
+load 1334647-1.html
+skip-if(geckoview) load 1349067.html # Bug 1563214 for GV+WR
+skip-if(ThreadSanitizer) pref(gfx.offscreencanvas.enabled,true) load 1348976-1.html
+load 1357092.html
+load 1441613.html
+pref(gfx.offscreencanvas.enabled,true) load 1443671.html
+pref(gfx.offscreencanvas.enabled,true) load 1546390.html
+load 1549853.html
+load 1551745.html
+load 1569648.html
+skip-if(!winWidget||!isDebugBuild) pref(layers.gpu-process.crash-also-crashes-browser,true) load 1654477.html
+load 1739454-1.html
+load 1740031.html
+pref(webgl.enable-privileged-extensions,true) load 1744172.html
+load 1757925-1.html
+load 1757755.html
+pref(gfx.offscreencanvas.enabled,true) load 1769878.html
+pref(gfx.offscreencanvas.enabled,true) load 1771007-1.html
+pref(dom.webgpu.enabled,true) load 1816140.html
+load 1849704-1.html
+load 1857986.html
+load 1873790.html
diff --git a/dom/canvas/crashtests/texImage2D.html b/dom/canvas/crashtests/texImage2D.html
new file mode 100644
index 0000000000..370b008572
--- /dev/null
+++ b/dom/canvas/crashtests/texImage2D.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<canvas></canvas>
+<script>
+var canvas = document.body.firstChild,
+    gl = canvas.getContext("experimental-webgl");
+gl.texImage2D(0, 0, 0, 0, 0, { get width() { throw 7 }, get height() { throw 7 }, data: new Uint8ClampedArray(10) });
+gl.texSubImage2D(0, 0, 0, 0, 0, 0, { get width() { throw 7 }, get height() { throw 7 }, data: new Uint8ClampedArray(10) });
+</script>
-- 
cgit v1.2.3