summaryrefslogtreecommitdiffstats
path: root/dom/media/test/crashtests
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 19:33:14 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 19:33:14 +0000
commit36d22d82aa202bb199967e9512281e9a53db42c9 (patch)
tree105e8c98ddea1c1e4784a60a5a6410fa416be2de /dom/media/test/crashtests
parentInitial commit. (diff)
downloadfirefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.tar.xz
firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.zip
Adding upstream version 115.7.0esr.upstream/115.7.0esr
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'dom/media/test/crashtests')
-rw-r--r--dom/media/test/crashtests/0-timescale.html14
-rw-r--r--dom/media/test/crashtests/0-timescale.mp4bin0 -> 14718 bytes
-rw-r--r--dom/media/test/crashtests/1012609.html9
-rw-r--r--dom/media/test/crashtests/1015662.html4
-rw-r--r--dom/media/test/crashtests/1028458.html23
-rw-r--r--dom/media/test/crashtests/1041466.html21
-rw-r--r--dom/media/test/crashtests/1045650.html18
-rw-r--r--dom/media/test/crashtests/1080986.html3
-rw-r--r--dom/media/test/crashtests/1080986.wavbin0 -> 592 bytes
-rw-r--r--dom/media/test/crashtests/1122218.html24
-rw-r--r--dom/media/test/crashtests/1127188.html3
-rw-r--r--dom/media/test/crashtests/1157994.html21
-rw-r--r--dom/media/test/crashtests/1158427.html21
-rw-r--r--dom/media/test/crashtests/1180881.html8
-rw-r--r--dom/media/test/crashtests/1180881.webmbin0 -> 524 bytes
-rw-r--r--dom/media/test/crashtests/1185176.html24
-rw-r--r--dom/media/test/crashtests/1185191.html21
-rw-r--r--dom/media/test/crashtests/1185192.html18
-rw-r--r--dom/media/test/crashtests/1197935.html8
-rw-r--r--dom/media/test/crashtests/1197935.mp4bin0 -> 1806042 bytes
-rw-r--r--dom/media/test/crashtests/1223670.html23
-rw-r--r--dom/media/test/crashtests/1236639.html9
-rw-r--r--dom/media/test/crashtests/1236639.mp3bin0 -> 1080 bytes
-rw-r--r--dom/media/test/crashtests/1257700.html8
-rw-r--r--dom/media/test/crashtests/1257700.webmbin0 -> 59264 bytes
-rw-r--r--dom/media/test/crashtests/1267263.html19
-rw-r--r--dom/media/test/crashtests/1270303.html8
-rw-r--r--dom/media/test/crashtests/1270303.webmbin0 -> 5822 bytes
-rw-r--r--dom/media/test/crashtests/1291702.html72
-rw-r--r--dom/media/test/crashtests/1368490.html30
-rw-r--r--dom/media/test/crashtests/1378826.html46
-rw-r--r--dom/media/test/crashtests/1384248.html10
-rw-r--r--dom/media/test/crashtests/1388372.html13
-rw-r--r--dom/media/test/crashtests/1389304.html32
-rw-r--r--dom/media/test/crashtests/1389304.mp4bin0 -> 198320 bytes
-rw-r--r--dom/media/test/crashtests/1393272.webmbin0 -> 6781 bytes
-rw-r--r--dom/media/test/crashtests/1411322.html18
-rw-r--r--dom/media/test/crashtests/1450845.html34
-rw-r--r--dom/media/test/crashtests/1489160.html10
-rw-r--r--dom/media/test/crashtests/1494073.html19
-rw-r--r--dom/media/test/crashtests/1517199.html17
-rw-r--r--dom/media/test/crashtests/1526044.html19
-rw-r--r--dom/media/test/crashtests/1530897.webmbin0 -> 509 bytes
-rw-r--r--dom/media/test/crashtests/1538727.html14
-rw-r--r--dom/media/test/crashtests/1545133.html34
-rw-r--r--dom/media/test/crashtests/1547784.html33
-rw-r--r--dom/media/test/crashtests/1547899.html20
-rw-r--r--dom/media/test/crashtests/1560215.html20
-rw-r--r--dom/media/test/crashtests/1569645.html23
-rw-r--r--dom/media/test/crashtests/1575271.html25
-rw-r--r--dom/media/test/crashtests/1577184.html15
-rw-r--r--dom/media/test/crashtests/1587248.html23
-rw-r--r--dom/media/test/crashtests/1594466.html22
-rw-r--r--dom/media/test/crashtests/1601385.html12
-rw-r--r--dom/media/test/crashtests/1601422.html20
-rw-r--r--dom/media/test/crashtests/1604941.html22
-rw-r--r--dom/media/test/crashtests/1608286.html50
-rw-r--r--dom/media/test/crashtests/1673525.html15
-rw-r--r--dom/media/test/crashtests/1673526-1.html20
-rw-r--r--dom/media/test/crashtests/1673526-2.html20
-rw-r--r--dom/media/test/crashtests/1693043.html21
-rw-r--r--dom/media/test/crashtests/1696511.html22
-rw-r--r--dom/media/test/crashtests/1697521.html19
-rw-r--r--dom/media/test/crashtests/1708790.html22
-rw-r--r--dom/media/test/crashtests/1709130.html19
-rw-r--r--dom/media/test/crashtests/1734008.html22
-rw-r--r--dom/media/test/crashtests/1734008.webmbin0 -> 8253 bytes
-rw-r--r--dom/media/test/crashtests/1741677.html15
-rw-r--r--dom/media/test/crashtests/1748272.html12
-rw-r--r--dom/media/test/crashtests/1752917.html18
-rw-r--r--dom/media/test/crashtests/1762620.html8
-rw-r--r--dom/media/test/crashtests/1765842.html8
-rw-r--r--dom/media/test/crashtests/1765842.webmbin0 -> 17210 bytes
-rw-r--r--dom/media/test/crashtests/1787281.html13
-rw-r--r--dom/media/test/crashtests/1787281.mp4bin0 -> 2736 bytes
-rw-r--r--dom/media/test/crashtests/1798778.html11
-rw-r--r--dom/media/test/crashtests/1833894.mp4bin0 -> 1000465 bytes
-rw-r--r--dom/media/test/crashtests/1833896.mp4bin0 -> 38215 bytes
-rw-r--r--dom/media/test/crashtests/1835164.html13
-rw-r--r--dom/media/test/crashtests/1835164.opusbin0 -> 2250 bytes
-rw-r--r--dom/media/test/crashtests/1840002.webmbin0 -> 512 bytes
-rw-r--r--dom/media/test/crashtests/1845350.mp4bin0 -> 1045 bytes
-rw-r--r--dom/media/test/crashtests/255ch.wavbin0 -> 68318 bytes
-rw-r--r--dom/media/test/crashtests/459439-1.html36
-rw-r--r--dom/media/test/crashtests/466607-1.html14
-rw-r--r--dom/media/test/crashtests/466945-1.html25
-rw-r--r--dom/media/test/crashtests/468763-1.html1
-rw-r--r--dom/media/test/crashtests/474744-1.html15
-rw-r--r--dom/media/test/crashtests/481136-1.html3
-rw-r--r--dom/media/test/crashtests/492286-1.xhtml1
-rw-r--r--dom/media/test/crashtests/493915-1.html18
-rw-r--r--dom/media/test/crashtests/495794-1.html8
-rw-r--r--dom/media/test/crashtests/495794-1.oggbin0 -> 4837 bytes
-rw-r--r--dom/media/test/crashtests/497734-1.xhtml21
-rw-r--r--dom/media/test/crashtests/497734-2.html17
-rw-r--r--dom/media/test/crashtests/576612-1.html15
-rw-r--r--dom/media/test/crashtests/691096-1.html31
-rw-r--r--dom/media/test/crashtests/752784-1.html15
-rw-r--r--dom/media/test/crashtests/789075-1.html20
-rw-r--r--dom/media/test/crashtests/789075.webmbin0 -> 12294 bytes
-rw-r--r--dom/media/test/crashtests/795892-1.html23
-rw-r--r--dom/media/test/crashtests/844563.html5
-rw-r--r--dom/media/test/crashtests/846612.html8
-rw-r--r--dom/media/test/crashtests/852838.html11
-rw-r--r--dom/media/test/crashtests/865004.html19
-rw-r--r--dom/media/test/crashtests/865537-1.html13
-rw-r--r--dom/media/test/crashtests/865550.html22
-rw-r--r--dom/media/test/crashtests/868504.html14
-rw-r--r--dom/media/test/crashtests/874869.html15
-rw-r--r--dom/media/test/crashtests/874915.html24
-rw-r--r--dom/media/test/crashtests/874934.html23
-rw-r--r--dom/media/test/crashtests/874952.html11
-rw-r--r--dom/media/test/crashtests/875144.html81
-rw-r--r--dom/media/test/crashtests/875596.html12
-rw-r--r--dom/media/test/crashtests/875911.html3
-rw-r--r--dom/media/test/crashtests/876024-1.html5
-rw-r--r--dom/media/test/crashtests/876024-2.html17
-rw-r--r--dom/media/test/crashtests/876118.html16
-rw-r--r--dom/media/test/crashtests/876207.html30
-rw-r--r--dom/media/test/crashtests/876215.html14
-rw-r--r--dom/media/test/crashtests/876249.html27
-rw-r--r--dom/media/test/crashtests/876252.html23
-rw-r--r--dom/media/test/crashtests/876834.html4
-rw-r--r--dom/media/test/crashtests/877527.html37
-rw-r--r--dom/media/test/crashtests/877820.html4
-rw-r--r--dom/media/test/crashtests/878014.html31
-rw-r--r--dom/media/test/crashtests/878328.html5
-rw-r--r--dom/media/test/crashtests/878407.html11
-rw-r--r--dom/media/test/crashtests/878478.html30
-rw-r--r--dom/media/test/crashtests/880129.html9
-rw-r--r--dom/media/test/crashtests/880202.html33
-rw-r--r--dom/media/test/crashtests/880342-1.html208
-rw-r--r--dom/media/test/crashtests/880342-2.html8
-rw-r--r--dom/media/test/crashtests/880384.html8
-rw-r--r--dom/media/test/crashtests/880404.html6
-rw-r--r--dom/media/test/crashtests/880724.html13
-rw-r--r--dom/media/test/crashtests/881775.html25
-rw-r--r--dom/media/test/crashtests/882956.html15
-rw-r--r--dom/media/test/crashtests/884459.html12
-rw-r--r--dom/media/test/crashtests/889042.html4
-rw-r--r--dom/media/test/crashtests/907986-1.html17
-rw-r--r--dom/media/test/crashtests/907986-2.html17
-rw-r--r--dom/media/test/crashtests/907986-3.html17
-rw-r--r--dom/media/test/crashtests/907986-4.html15
-rw-r--r--dom/media/test/crashtests/910171-1.html17
-rw-r--r--dom/media/test/crashtests/920987.html6
-rw-r--r--dom/media/test/crashtests/925619-1.html14
-rw-r--r--dom/media/test/crashtests/925619-2.html15
-rw-r--r--dom/media/test/crashtests/926619.html24
-rw-r--r--dom/media/test/crashtests/933151.html16
-rw-r--r--dom/media/test/crashtests/933156.html23
-rw-r--r--dom/media/test/crashtests/944851.html17
-rw-r--r--dom/media/test/crashtests/952756.html19
-rw-r--r--dom/media/test/crashtests/986901.html16
-rw-r--r--dom/media/test/crashtests/990794.html22
-rw-r--r--dom/media/test/crashtests/995289.html9
-rw-r--r--dom/media/test/crashtests/adts-truncated.aacbin0 -> 512 bytes
-rw-r--r--dom/media/test/crashtests/adts.aacbin0 -> 8537 bytes
-rw-r--r--dom/media/test/crashtests/analyser-channels-1.html16
-rw-r--r--dom/media/test/crashtests/audiocontext-after-unload-1.html27
-rw-r--r--dom/media/test/crashtests/audiocontext-after-xhr.html13
-rw-r--r--dom/media/test/crashtests/audiocontext-double-suspend.html5
-rw-r--r--dom/media/test/crashtests/audioworkletnode-after-unload-1.html27
-rw-r--r--dom/media/test/crashtests/buffer-source-duration-1.html14
-rw-r--r--dom/media/test/crashtests/buffer-source-ended-1.html16
-rw-r--r--dom/media/test/crashtests/buffer-source-resampling-start-1.html16
-rw-r--r--dom/media/test/crashtests/buffer-source-slow-resampling-1.html34
-rw-r--r--dom/media/test/crashtests/channel-count-in-metadata-different-than-in-content.mp4bin0 -> 13651 bytes
-rw-r--r--dom/media/test/crashtests/convolver-memory-report-1.html25
-rw-r--r--dom/media/test/crashtests/copyFromChannel-2.html16
-rw-r--r--dom/media/test/crashtests/cors.webmbin0 -> 215529 bytes
-rw-r--r--dom/media/test/crashtests/cors.webm^headers^1
-rw-r--r--dom/media/test/crashtests/crashtests.list169
-rw-r--r--dom/media/test/crashtests/disconnect-wrong-destination.html13
-rw-r--r--dom/media/test/crashtests/doppler-1.html23
-rw-r--r--dom/media/test/crashtests/empty-buffer-source.html14
-rw-r--r--dom/media/test/crashtests/empty-samples.webm0
-rw-r--r--dom/media/test/crashtests/encrypted-track-with-bad-sample-description-index.mp4bin0 -> 198320 bytes
-rw-r--r--dom/media/test/crashtests/encrypted-track-with-sample-missing-cenc-aux.mp4bin0 -> 152132 bytes
-rw-r--r--dom/media/test/crashtests/encrypted-track-without-tenc.mp4bin0 -> 152132 bytes
-rw-r--r--dom/media/test/crashtests/media-element-source-seek-1.html27
-rw-r--r--dom/media/test/crashtests/mp4_box_emptyrange.mp4bin0 -> 918 bytes
-rw-r--r--dom/media/test/crashtests/offline-buffer-source-ended-1.html15
-rw-r--r--dom/media/test/crashtests/oscillator-ended-1.html15
-rw-r--r--dom/media/test/crashtests/oscillator-ended-2.html15
-rw-r--r--dom/media/test/crashtests/sound.oggbin0 -> 2603 bytes
-rw-r--r--dom/media/test/crashtests/test.mp4bin0 -> 11817 bytes
-rw-r--r--dom/media/test/crashtests/track-with-zero-dimensions.mp4bin0 -> 11817 bytes
-rw-r--r--dom/media/test/crashtests/video-crash.webmbin0 -> 58482 bytes
-rw-r--r--dom/media/test/crashtests/video-replay-after-audio-end.html43
190 files changed, 3165 insertions, 0 deletions
diff --git a/dom/media/test/crashtests/0-timescale.html b/dom/media/test/crashtests/0-timescale.html
new file mode 100644
index 0000000000..db845096dd
--- /dev/null
+++ b/dom/media/test/crashtests/0-timescale.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+</head>
+<body>
+<!-- This video file has a timescale of 0 in the mdhd atom -->
+<video src="0-timescale.mp4"
+ autoplay
+ onerror="document.documentElement.className=undefined"
+ onloadedmetadata="this.src=''; document.documentElement.className=undefined">
+<!-- Note we reset 'src' to release decoder resources and cubeb streams to prevent OOM or OpenCubeb() failures. -->
+</video>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/0-timescale.mp4 b/dom/media/test/crashtests/0-timescale.mp4
new file mode 100644
index 0000000000..32df5dc5a5
--- /dev/null
+++ b/dom/media/test/crashtests/0-timescale.mp4
Binary files differ
diff --git a/dom/media/test/crashtests/1012609.html b/dom/media/test/crashtests/1012609.html
new file mode 100644
index 0000000000..1dad783a07
--- /dev/null
+++ b/dom/media/test/crashtests/1012609.html
@@ -0,0 +1,9 @@
+<script>
+try{var r0=new AudioContext();}catch(e){}
+try{var r32=r0.createOscillator();}catch(e){}
+try{var r58=r0.createPeriodicWave(new Float32Array(1997),new Float32Array(1997));}catch(e){}
+try{r32.start(0);}catch(e){}
+try{r32.setPeriodicWave(r58);}catch(e){}
+try{r32.frequency.value=-1;}catch(e){}
+</script>
+
diff --git a/dom/media/test/crashtests/1015662.html b/dom/media/test/crashtests/1015662.html
new file mode 100644
index 0000000000..20407c807d
--- /dev/null
+++ b/dom/media/test/crashtests/1015662.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<body>
+<video><track src="javascript:5"></track></video>
+</body>
diff --git a/dom/media/test/crashtests/1028458.html b/dom/media/test/crashtests/1028458.html
new file mode 100644
index 0000000000..bb01e3343a
--- /dev/null
+++ b/dom/media/test/crashtests/1028458.html
@@ -0,0 +1,23 @@
+<html class="reftest-wait">
+<audio id="testAudio" controls></audio>
+<script type="text/javascript">
+navigator.mozGetUserMedia({audio: true, fake: true}, function(stream) {
+ stream.getAudioTracks()[0].enabled = false;
+ var testAudio = document.getElementById('testAudio');
+ // Wait some time for good measure
+ var eventReceived = 0;
+ testAudio.addEventListener("timeupdate", function() {
+ if (++eventReceived == 3) {
+ document.querySelector("html").className = "";
+ }
+ })
+ testAudio.srcObject = stream;
+ testAudio.play();
+ }, function(err) {
+ // Don't go orange if we can't get an audio input stream,
+ // as this is not what we are trying to test and can happen on Windows.
+ document.querySelector("html").className = "";
+ });
+</script>
+
+</html>
diff --git a/dom/media/test/crashtests/1041466.html b/dom/media/test/crashtests/1041466.html
new file mode 100644
index 0000000000..0f064d186c
--- /dev/null
+++ b/dom/media/test/crashtests/1041466.html
@@ -0,0 +1,21 @@
+<html>
+<script>
+try{var Context1= new (window.webkitAudioContext || window.AudioContext)()}catch(e){}
+try{var Delay0=Context1.createDelay();}catch(e){}
+try{var ScriptProcessor0=Context1.createScriptProcessor(512,26,7);}catch(e){}
+try{var ChannelSplitter0=Context1.createChannelSplitter(91);}catch(e){}
+try{var Gain1=Context1.createGain();}catch(e){}
+try{var WaveShaper0=Context1.createWaveShaper();}catch(e){}
+try{var Analyser1=Context1.createAnalyser();}catch(e){}
+try{Gain1.connect(Delay0);}catch(e){}
+try{Analyser1.connect(BiquadFilter0);}catch(e){}
+try{Gain1.connect(Context1.destination);}catch(e){}
+try{WaveShaper0.connect(ScriptProcessor0);}catch(e){}
+try{ChannelSplitter0.connect(BiquadFilter1);}catch(e){}
+try{Delay0.connect(Gain1);}catch(e){}
+try{ScriptProcessor0.connect(Context1.destination);}catch(e){}
+try{WaveShaper0.connect(Gain1);}catch(e){}
+try{WaveShaper0.connect(ChannelSplitter0);}catch(e){}
+try{ScriptProcessor0.connect(WaveShaper0);}catch(e){}
+</script>
+</html>
diff --git a/dom/media/test/crashtests/1045650.html b/dom/media/test/crashtests/1045650.html
new file mode 100644
index 0000000000..32acd2ce75
--- /dev/null
+++ b/dom/media/test/crashtests/1045650.html
@@ -0,0 +1,18 @@
+<html><body><script>
+
+var r0=new AudioContext();
+
+var splitter=r0.createChannelSplitter();
+var delay=r0.createDelay();
+var scriptp=r0.createScriptProcessor();
+var cmerger=r0.createChannelMerger();
+var gain=r0.createGain();
+
+splitter.connect(delay,2);
+delay.connect(scriptp);
+scriptp.connect(cmerger);
+cmerger.connect(splitter);
+gain.connect(gain);
+gain.connect(cmerger);
+
+</script></body></html>
diff --git a/dom/media/test/crashtests/1080986.html b/dom/media/test/crashtests/1080986.html
new file mode 100644
index 0000000000..1de3075169
--- /dev/null
+++ b/dom/media/test/crashtests/1080986.html
@@ -0,0 +1,3 @@
+<html>
+<audio autoplay src="1080986.wav"></audio>
+</html>
diff --git a/dom/media/test/crashtests/1080986.wav b/dom/media/test/crashtests/1080986.wav
new file mode 100644
index 0000000000..b96c59b7ec
--- /dev/null
+++ b/dom/media/test/crashtests/1080986.wav
Binary files differ
diff --git a/dom/media/test/crashtests/1122218.html b/dom/media/test/crashtests/1122218.html
new file mode 100644
index 0000000000..984487dd21
--- /dev/null
+++ b/dom/media/test/crashtests/1122218.html
@@ -0,0 +1,24 @@
+<html>
+<head>
+<script>
+function boom() {
+ var r0=new AudioContext();
+
+ var cm=r0.createChannelMerger(20);
+
+ var o1=r0.createOscillator();
+ var o2=r0.createOscillator();
+
+ var pw=r0.createPeriodicWave(new Float32Array(4),new Float32Array(4));
+ o2.setPeriodicWave(pw);
+
+ o1.connect(cm);
+ cm.connect(o2.frequency);
+
+ o1.start();
+ o2.start(0.476);
+}
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/media/test/crashtests/1127188.html b/dom/media/test/crashtests/1127188.html
new file mode 100644
index 0000000000..650f07dd47
--- /dev/null
+++ b/dom/media/test/crashtests/1127188.html
@@ -0,0 +1,3 @@
+<script>
+ (new AudioContext).close();
+</script>
diff --git a/dom/media/test/crashtests/1157994.html b/dom/media/test/crashtests/1157994.html
new file mode 100644
index 0000000000..2e3001302a
--- /dev/null
+++ b/dom/media/test/crashtests/1157994.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var ac = new AudioContext();
+ // first "suspended" -> "running" transition
+ ac.onstatechange = function() {
+ ac.onstatechange = null;
+ ac.suspend();
+ ac.close();
+ }
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
+
diff --git a/dom/media/test/crashtests/1158427.html b/dom/media/test/crashtests/1158427.html
new file mode 100644
index 0000000000..b544a942a1
--- /dev/null
+++ b/dom/media/test/crashtests/1158427.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ dump("before capture\n");
+ document.createElement("audio").mozCaptureStreamUntilEnded();
+ dump("before context\n");
+ new window.AudioContext();
+ dump("before gc\n");
+ SpecialPowers.forceCC();
+ dump("after gc\n");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
+
diff --git a/dom/media/test/crashtests/1180881.html b/dom/media/test/crashtests/1180881.html
new file mode 100644
index 0000000000..d5bf2f5642
--- /dev/null
+++ b/dom/media/test/crashtests/1180881.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+<video src="1180881.webm" autoplay></video>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1180881.webm b/dom/media/test/crashtests/1180881.webm
new file mode 100644
index 0000000000..2fb2be7a7f
--- /dev/null
+++ b/dom/media/test/crashtests/1180881.webm
Binary files differ
diff --git a/dom/media/test/crashtests/1185176.html b/dom/media/test/crashtests/1185176.html
new file mode 100644
index 0000000000..d5e9b68a29
--- /dev/null
+++ b/dom/media/test/crashtests/1185176.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+ var ac = new window.AudioContext();
+ var oscillator = ac.createOscillator();
+ oscillator.start(0);
+ oscillator.stop(0.1);
+ setTimeout(function() {
+ oscillator.channelCount = 1;
+ oscillator.channelCountMode = "explicit";
+ oscillator.channelInterpretation = "speakers";
+ document.documentElement.removeAttribute("class");
+ }, 1000);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
+
diff --git a/dom/media/test/crashtests/1185191.html b/dom/media/test/crashtests/1185191.html
new file mode 100644
index 0000000000..4ed5ba2ee2
--- /dev/null
+++ b/dom/media/test/crashtests/1185191.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+ var a = new AudioContext();
+ var b = new BroadcastChannel("x");
+ a.addEventListener("statechange", bye, false);
+}
+
+function bye()
+{
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/media/test/crashtests/1185192.html b/dom/media/test/crashtests/1185192.html
new file mode 100644
index 0000000000..46fa311aa2
--- /dev/null
+++ b/dom/media/test/crashtests/1185192.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ new Audio().mozCaptureStreamUntilEnded();
+ var ac = new window.AudioContext();
+ ac.resume();
+ ac.close();
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
+
diff --git a/dom/media/test/crashtests/1197935.html b/dom/media/test/crashtests/1197935.html
new file mode 100644
index 0000000000..dd8ad0382d
--- /dev/null
+++ b/dom/media/test/crashtests/1197935.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+<video src="1197935.mp4" autoplay></video>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1197935.mp4 b/dom/media/test/crashtests/1197935.mp4
new file mode 100644
index 0000000000..f00de75627
--- /dev/null
+++ b/dom/media/test/crashtests/1197935.mp4
Binary files differ
diff --git a/dom/media/test/crashtests/1223670.html b/dom/media/test/crashtests/1223670.html
new file mode 100644
index 0000000000..94cad43e23
--- /dev/null
+++ b/dom/media/test/crashtests/1223670.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+
+ var ac = new window.AudioContext("publicnotification");
+
+ setTimeout(function() {
+ document.documentElement.removeAttribute("class");
+ var htmlAudio = new Audio();
+ var stream = htmlAudio.mozCaptureStreamUntilEnded();
+ ac.createMediaStreamSource(stream);
+ }, 0);
+}
+
+</script>
+</head>
+<body onload="boom();">
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1236639.html b/dom/media/test/crashtests/1236639.html
new file mode 100644
index 0000000000..5c4634a4d4
--- /dev/null
+++ b/dom/media/test/crashtests/1236639.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <title>Bug 1236639: Crash on audio playback due to invalid XING headers</title>
+</head>
+<body>
+<audio autoplay src="1236639.mp3"></audio>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1236639.mp3 b/dom/media/test/crashtests/1236639.mp3
new file mode 100644
index 0000000000..8ef96e8cc7
--- /dev/null
+++ b/dom/media/test/crashtests/1236639.mp3
Binary files differ
diff --git a/dom/media/test/crashtests/1257700.html b/dom/media/test/crashtests/1257700.html
new file mode 100644
index 0000000000..5377b17da5
--- /dev/null
+++ b/dom/media/test/crashtests/1257700.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+<video src="1257700.webm" autoplay></video>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1257700.webm b/dom/media/test/crashtests/1257700.webm
new file mode 100644
index 0000000000..63e53c8c0a
--- /dev/null
+++ b/dom/media/test/crashtests/1257700.webm
Binary files differ
diff --git a/dom/media/test/crashtests/1267263.html b/dom/media/test/crashtests/1267263.html
new file mode 100644
index 0000000000..a4d0e621cd
--- /dev/null
+++ b/dom/media/test/crashtests/1267263.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ vid.setMediaKeys(null);
+ vid.fastSeek(111);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+ <video id="vid" src="../../../../layout/reftests/webm-video/frames.webm"></video>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1270303.html b/dom/media/test/crashtests/1270303.html
new file mode 100644
index 0000000000..23608bb2b8
--- /dev/null
+++ b/dom/media/test/crashtests/1270303.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+<video src="1270303.webm" autoplay></video>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1270303.webm b/dom/media/test/crashtests/1270303.webm
new file mode 100644
index 0000000000..c9b0003d6b
--- /dev/null
+++ b/dom/media/test/crashtests/1270303.webm
Binary files differ
diff --git a/dom/media/test/crashtests/1291702.html b/dom/media/test/crashtests/1291702.html
new file mode 100644
index 0000000000..54f17b45b8
--- /dev/null
+++ b/dom/media/test/crashtests/1291702.html
@@ -0,0 +1,72 @@
+<script>
+Logger={}; Logger.JSError=function(e){};
+try { o0 = new Audio("media/audio/mono-uncompressed-8bit-44100hz.wav") } catch(e) { Logger.JSError(e); }
+try { o1 = o0.mozCaptureStreamUntilEnded() } catch(e) { Logger.JSError(e); }
+try { o2 = new window.AudioContext(); } catch(e) { Logger.JSError(e); }
+try { o3 = o2.createBufferSource(); } catch(e) { Logger.JSError(e); }
+try { o5 = o2.createChannelMerger(3); } catch(e) { Logger.JSError(e); }
+try { o3.start(0) } catch(e) { Logger.JSError(e); }
+try { o2.listener.setPosition(0.0417049336344248, 0.9932504594310304, 32) } catch(e) { Logger.JSError(e); }
+try { o5.disconnect(0) } catch(e) { Logger.JSError(e); }
+try { o0.mozGetMetadata() } catch(e) { Logger.JSError(e); }
+try { o3.channelCount = 1; } catch(e) { Logger.JSError(e); }
+try { o3.buffer = function anonymous() {
+var buffer = o2.createBuffer(1, 512, o2.sampleRate);for(var c=0;c<1;c++) {var data = buffer.getChannelData(c);for(var i=0;i<512;i++) {data[i] = i % 512}}return buffer;
+}(); } catch(e) { Logger.JSError(e); }
+try { o3.loop = false; } catch(e) { Logger.JSError(e); }
+try { o0.preservesPitch = false; } catch(e) { Logger.JSError(e); }
+try { o2.destination.channelCount = 1; } catch(e) { Logger.JSError(e); }
+try { o3.loopStart = 8; } catch(e) { Logger.JSError(e); }
+try { o3.playbackRate.value = 0.46271130895770884; } catch(e) { Logger.JSError(e); }
+try { o2.listener.setVelocity(0.34781960219792546, 4, 2048) } catch(e) { Logger.JSError(e); }
+try { o5.connect(o5, 0, 0) } catch(e) { Logger.JSError(e); }
+try { o3.loopStart = -0.24696638021780326; } catch(e) { Logger.JSError(e); }
+try { o0.mozSetup(1, 44100) } catch(e) { Logger.JSError(e); }
+try { o3.buffer.copyToChannel(function anonymous() {
+var buffer=new Float32Array(256);for(var i=0;i<256;i++){buffer[i]=i / 256}return buffer;
+}(), 1, 2048, 64) } catch(e) { Logger.JSError(e); }
+try { o3.loop = false; } catch(e) { Logger.JSError(e); }
+try { setInterval(function anonymous() {
+try { o0.pause() } catch(e) { Logger.JSError(e); }
+}, 12.902067779658143) } catch(e) { Logger.JSError(e); }
+try { o2.listener.setPosition(256, 256, 16) } catch(e) { Logger.JSError(e); }
+try { o3.playbackRate.setValueCurveAtTime(function anonymous() {
+var buffer=new Float32Array(4);for(var i=0;i<4;i++){buffer[i]=i / 4}return buffer;
+}(), 2, 0.40792575814014437) } catch(e) { Logger.JSError(e); }
+try { o3.playbackRate.value = 0.4997270553139334; } catch(e) { Logger.JSError(e); }
+try { o0.loop = true; } catch(e) { Logger.JSError(e); }
+try { o3.loopStart = 4; } catch(e) { Logger.JSError(e); }
+try { setInterval(function anonymous() {
+try { o3.buffer = function anonymous() {
+var buffer = o2.createBuffer(1, 1, o2.sampleRate);for(var c=0;c<1;c++) {var data = buffer.getChannelData(c);for(var i=0;i<1;i++) {data[i] = Math.sin(Math.sin(i))}}return buffer;
+}() } catch(e) { Logger.JSError(e); }
+}, 54.32078602859342) } catch(e) { Logger.JSError(e); }
+try { o3.connect(o2.destination); } catch(e) { Logger.JSError(e); }
+try { o3.channelCountMode = 'max'; } catch(e) { Logger.JSError(e); }
+try { setInterval(function anonymous() {
+try { o3.channelCount = 1; } catch(e) { Logger.JSError(e); }
+}, 55.448587039802966) } catch(e) { Logger.JSError(e); }
+try { o3.playbackRate.cancelScheduledValues(0.7190983131805198) } catch(e) { Logger.JSError(e); }
+try { o3.playbackRate.cancelScheduledValues(16) } catch(e) { Logger.JSError(e); }
+try { o3.connect(o5, 0, 2) } catch(e) { Logger.JSError(e); }
+try { o3.loopEnd = 0.5864771678080962; } catch(e) { Logger.JSError(e); }
+try { o0.playbackRate = 0.2781783298771312; } catch(e) { Logger.JSError(e); }
+try { o0.loop = false; } catch(e) { Logger.JSError(e); }
+try { setInterval(function anonymous() {
+try { o5.disconnect(0) } catch(e) { Logger.JSError(e); }
+}, 29.75776777646425) } catch(e) { Logger.JSError(e); }
+try { o3.playbackRate.setValueCurveAtTime(function anonymous() {
+var buffer=new Float32Array(8);for(var i=0;i<8;i++){buffer[i]=8 % 8}return buffer;
+}(), 0.4972710112336257, 64) } catch(e) { Logger.JSError(e); }
+try { setInterval(function anonymous() {
+try { o0.controls = false; } catch(e) { Logger.JSError(e); }
+}, 22.550249570567694) } catch(e) { Logger.JSError(e); }
+try { o2.listener.setOrientation(0.6531494410366634, 64, 0.5120918081402992, -64, 0.32912433155093446, 256) } catch(e) { Logger.JSError(e); }
+try { o3.loop = true; } catch(e) { Logger.JSError(e); }
+try { o3.connect(o5, 0, 0) } catch(e) { Logger.JSError(e); }
+try { o3.buffer = function anonymous() {
+var buffer = o2.createBuffer(1, 2048, 48000);for(var c=0;c<1;c++) {var data = buffer.getChannelData(c);for(var i=0;i<2048;i++) {data[i] = Math.sin(Math.sin(2048 * 0.2519529190035427))}}return buffer;
+}(); } catch(e) { Logger.JSError(e); }
+try { o3.disconnect(0) } catch(e) { Logger.JSError(e); }
+</script>
+
diff --git a/dom/media/test/crashtests/1368490.html b/dom/media/test/crashtests/1368490.html
new file mode 100644
index 0000000000..8a2d9f9674
--- /dev/null
+++ b/dom/media/test/crashtests/1368490.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+ <title> Bug 1368490 : Crash if media recorder source stream reduces number of channels. </title>
+</head>
+<meta charset="utf-8">
+<script type="text/javascript">
+
+function boom() {
+ let audioContext = new window.AudioContext();
+ let oscillator = audioContext.createOscillator();
+ let dst = audioContext.createMediaStreamDestination();
+ oscillator.channelCount = 4;
+ dst.channelCount = 4;
+ oscillator.connect(dst, 0, 0);
+ oscillator.start();
+ mediaRec = new MediaRecorder(dst.stream);
+
+ mediaRec.start(100);
+ setTimeout(() => {
+ dst.channelCount = 1;
+ setTimeout(() => {
+ mediaRec.stop();
+ document.documentElement.removeAttribute("class");
+ }, 100);
+ }, 100);
+}
+</script>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/media/test/crashtests/1378826.html b/dom/media/test/crashtests/1378826.html
new file mode 100644
index 0000000000..e1913cd0f5
--- /dev/null
+++ b/dom/media/test/crashtests/1378826.html
@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<title>Bug 1378826 : Removing last video track from recorder stream crashes.</title>
+</head>
+<body>
+<canvas id="canvas"></canvas>
+<script type="text/javascript">
+
+function wait(ms) {
+ return new Promise(resolve => setTimeout(resolve, ms));
+}
+
+function boom() {
+ let canvas = document.getElementById("canvas");
+ let ctx = canvas.getContext('2d');
+ ctx.fillRect(10, 10, 100, 100);
+ let stream = canvas.captureStream();
+ let rec = new MediaRecorder(stream);
+ // At the time of fixing this bug onstop would fire, but this may change in
+ // future. As such defensively listen for onerror too to prevent this test
+ // timing out.
+ let stoppedPromise = new Promise(y => (rec.onstop = y,
+ rec.onerror = e => y));
+ rec.onstart = () => {
+ // Remove the video track from the stream we're recording
+ stream.removeTrack(stream.getTracks()[0]);
+ // Recorder should stop or error in response to the above
+ return stoppedPromise
+ .then(() => {
+ // Little wait to help get bad writes if they're going to happen
+ wait(100)
+ .then(() => {
+ // Didn't crash, finish
+ document.documentElement.removeAttribute("class");
+ });
+ });
+ };
+ rec.start();
+}
+
+window.onload = boom;
+
+</script>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1384248.html b/dom/media/test/crashtests/1384248.html
new file mode 100644
index 0000000000..5d9c60edda
--- /dev/null
+++ b/dom/media/test/crashtests/1384248.html
@@ -0,0 +1,10 @@
+<html>
+ <head>
+ <script>
+ try { o1 = document.createElement('audio') } catch(e) { }
+ try { o2 = document.implementation.createDocument('', '', null).adoptNode(o1); } catch(e) { };
+ try { o3 = new AudioContext('alarm') } catch(e) { }
+ try { o3.createMediaElementSource(o1) } catch(e) { }
+ </script>
+ </head>
+</html>
diff --git a/dom/media/test/crashtests/1388372.html b/dom/media/test/crashtests/1388372.html
new file mode 100644
index 0000000000..977ebddf53
--- /dev/null
+++ b/dom/media/test/crashtests/1388372.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+navigator.mediaDevices.getUserMedia({audio: {
+ echoCancellation: false,
+ noiseSuppression: false,
+ autoGainControl: false
+ }, fake: true
+}).then((stream) => {
+ document.documentElement.removeAttribute("class");
+})
+</script>
+</html>
diff --git a/dom/media/test/crashtests/1389304.html b/dom/media/test/crashtests/1389304.html
new file mode 100644
index 0000000000..df419c51d7
--- /dev/null
+++ b/dom/media/test/crashtests/1389304.html
@@ -0,0 +1,32 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+ <title>Media test: Negative duration.</title>
+</head>
+<body>
+
+<video id="v" controls src="1389304.mp4">
+</video>
+<p id="msg"></p>
+
+<script type="text/javascript">
+
+function log(x) {
+ msg.innerHTML = x + "<br>";
+}
+
+v.play();
+v.onended = function() {
+ log("endded!");
+ let seekable = v.seekable;
+ for (let i = 0; i < seekable.length; ++i) {
+ let start = seekable.start(i);
+ let end = seekable.end(i);
+ log(`[${i}]: start=${start} end=${end}`);
+ }
+}
+
+</script>
+
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1389304.mp4 b/dom/media/test/crashtests/1389304.mp4
new file mode 100644
index 0000000000..25cd746972
--- /dev/null
+++ b/dom/media/test/crashtests/1389304.mp4
Binary files differ
diff --git a/dom/media/test/crashtests/1393272.webm b/dom/media/test/crashtests/1393272.webm
new file mode 100644
index 0000000000..1f1cade6dc
--- /dev/null
+++ b/dom/media/test/crashtests/1393272.webm
Binary files differ
diff --git a/dom/media/test/crashtests/1411322.html b/dom/media/test/crashtests/1411322.html
new file mode 100644
index 0000000000..772b68f0cc
--- /dev/null
+++ b/dom/media/test/crashtests/1411322.html
@@ -0,0 +1,18 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+ <title>Bug 1411322: Shutdown after getting memory reports from MediaRecorder</title>
+ <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+ <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<audio id="audio"></audio>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+let recorder = new MediaRecorder(audio.mozCaptureStream());
+recorder.start();
+SpecialPowers.getMemoryReports();
+</script>
+</pre>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1450845.html b/dom/media/test/crashtests/1450845.html
new file mode 100644
index 0000000000..451d116e83
--- /dev/null
+++ b/dom/media/test/crashtests/1450845.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+ <title>Bug 1450845: Avoid seek to next frame when already seeking</title>
+ <script>
+ async function boom() {
+ let video = document.getElementById('video');
+
+ // Internally play causes a seek, make sure we don't crash during this
+ video.play();
+ try {
+ await document.getElementById('video').seekToNextFrame();
+ } catch (e) {
+ // We don't mind if the promise was rejected so long as we don't crash
+ }
+ // Didn't crash
+
+ // Stop playback and cause a seek to 0
+ video.pause();
+ video.currentTime = 0;
+ try {
+ await document.getElementById('video').seekToNextFrame();
+ } finally {
+ // Didn't crash
+ document.documentElement.removeAttribute("class");
+ }
+ }
+ window.addEventListener('load', boom)
+ </script>
+</head>
+<body>
+ <video id='video' src='data:video/webm;base64,GkXfowEAAAAAAAAfQoaBAUL3gQFC8oEEQvOBQoWBAhhTgGcBAAAAAAAB6BFNm3RALE27i1OrhBVJqWZTrIHfTbuMU6uEFlSua1OsggEwTbuMU6uEHFO7a1OsggHL7AEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVSalmAQAAAAAAAEUqTYCNTGF2ZjU3LjI5LjEwMVdBjUxhdmY1Ny4yOS4xMDFzpJBAb17Yv2oNAF1ZEESuco33RImIQFCAAAAAAAAWVK5rAQAAAAAAADyuAQAAAAAAADPXgQFzxYEBnIEAIrWcg3VuZIaFVl9WUDmDgQEj44OEAfygVeABAAAAAAAAB7CCAUC6gfAfQ7Z1AQAAAAAAAEfngQCjqYEAAICCSYNCABPwDvYAOCQcGFQAAFBh9jAAABML7AAATEnjdRwIJ+gAo5eBACEAhgBAkpwATEAABCasAABekcXgAB'>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1489160.html b/dom/media/test/crashtests/1489160.html
new file mode 100644
index 0000000000..c4f643700c
--- /dev/null
+++ b/dom/media/test/crashtests/1489160.html
@@ -0,0 +1,10 @@
+<html>
+<head>
+<script>
+audio = new AudioContext()
+audio.close()
+audio.close()
+</script>
+</head>
+</html>
+
diff --git a/dom/media/test/crashtests/1494073.html b/dom/media/test/crashtests/1494073.html
new file mode 100644
index 0000000000..41e7a36554
--- /dev/null
+++ b/dom/media/test/crashtests/1494073.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+ <title>Bug 1494073: Setting playback rate too high</title>
+ <script>
+ function finish() {
+ document.documentElement.removeAttribute("class");
+ }
+ var src="data:audio/wav;base64,UklGRqsTAABXQVZFZm10IBAAAAABAAMA8FUAANABAQADAAgAZGF0YYcTAAAUCnYAPm6YALYJSgA4IO8A9UuWALiiZQAYWc4AnMNoAKcc9gBmWLcAtL0NAAGU0QDbSgMA777tAEkfrQD14E4A2nb/AERxxAD5c+0AmplbADUo0AC14DQAXWgRAGsl4wB0oGIAkVlkAOWmTwCm/fEAZqErAEHpqgAMXjkA5AlGAMsOOwAUQAsABvRfAJyVUwDTKM8AtIMYAKh6lQDPkq0A9JtqAKiudAD2I3wAHTsPAOy36ACLtz8ATQELAJCXQgDpxksA4BzzABSR7gD7vMEAgo/6AKovngCZNLoA0A5UALhiFABNVRQAjXIuABmhFACj8/sAt+bQAP71dgCbdGoAXuf5AN5zVAACgggAlHiqAGTPswC0x5oAsgxDAEimygCYlMUAS3r2AKFS0gCZzCYAnXPZAEU8cgAf2gQADqF2ACCY+ABSVIEAW17CANxZWQCk0s0AIF1kALYn7gC9U3MAQqRFAHSUegC1UR8Au99GADrbaQCQQksAOQ6kALUmMgAC0YQAS9rjAMNL9QAQKkcAayg7AOjHXgBNZxcAzIUrAAgq+ACVJPMAV5s2APTVsgAsxX4AMP9cAInlqADcltMAv10FAAzJAgDiHQ4AbsW4ACDTowC897AAx1A8AGw3JwBe6msAf/jJAL1PbwCYYRkAscdyACi8+QCXCEwABWnAAOz4QQC0W60AcToLAH4/+wBion0AzzBXAJCuHgAsv+gAvDmdAA1LaAC04xgA/KU6AAurkwCbpwkAzkTeAA9+SABQqJoAPFHNAK96FgDxMNkAaPelAOG5YgCJsS8AtUp8ALhn8gD7sIYAxoR+AMWFHgA3aRIA00/wABwXJwCmQVQAxU7xAGnkjABvBaUAMz8UAL7qjQBokUEAx8eOAAd/ogDKKqcAsx8EAEpW/AADoDAA/D1+AKVqMwDnkmYA/fOAAGpcfwAlm3UA5+t8AM5tMwCdW3cA2UzjABHxWQBKIx4A7bf3AC+RkgARtBAA27gWADcb/ADjO68AS+g0AMutgwAzRawAtbgLAGjfnwCGINIAowqrAFsDmACIyhgAHfz+AByCiABBwdYASnWAANadowA7KFYADTx1ALG1WAAm4csAti5iACQMZgAeg7MAtrnPAMRmsAAsONAAKR6XAEu5TQCrqMYAd0hcABAU8gCLBFEA2C0MAJ7nZwAETAYA6i53APxR2gDRwBsAf392AH/csgAidosA3MaAAKgCrQBwid4A4xUfAHpqnACYWcQAHfIoAO67cQBlKVUAfR6pAEvQyQDFcWoA82ivAGsVXAA5gcQA8YCIAH9igAC6EzIAvrJEACTfdgBM21wAE6W+ABkqTwAL0+wA85kAALdRfQDbetYAT9RxALUxoQDScSoACRY8AIOzSwAUQS4A6yG1ALDLIwCf5vUAUvQTAK8r+QC5zVoAckBEABQfYwBFzoQAEUyXANlojQBGhjMA0WNjAI0qOQC7TIkAMbboAAp5igBw640ArVL3ADsU7QBoR/cAemWCAChwZQDuILoApIhRAOXapADr/IAApX7IAKvnxABvSHgAV1k1ABqwegD4s6IAT4m1AH/wPgBEnc0AwuIVAO5lzgDsHIAA8O8QAPZZeAC68JcAMzVvAAVKUwBGXv0AaOoBACuF6QD9uBQAwGpOAEiF1wCq/1kAXLJ4AGP4xgC8uzMAHgMmAF3WXwCssiUAya68AP7FUwAkZqYAqnfsAJkuUgC+08cANBobALJvTgAtK7oAaIIoALfiPgAW5qAAO1YyAM9+owCFIMMAbL82ABfR7wBJrDgASc3DAB8q7AAi/80AxleNALQ+3wARtIIA3D9uAFWiEwBtshQAoPHFAITU8gA1S4EAB8w6ANZxHgBhLBEAx70EADf8KgADzHIAQ4ONAEyVRgAXxdIAoS0hAHkIhwBUeFgAOP1YAM6KtgAJaJ0AuaUnADdSkQDNaVIAJkoIAFVlkAARLYwAc2jBAEHoeQBMnFIAQS8hAKUu2ABZafMAQRGbAElVMgAdHRgA9ImMAF4/NADLcZMAiaXbAB0rpQB1RTEAGqsMAGYPWgAB4nkAEk/2AOg7lQC5bI8A7x5cALOosgDQV7YA8mwTACI31wCjuIAAegycABfkWwBSqBQApdm/AIqmCgBEp3QANDopAHSFjgDOIKgABWL8AOppagBvyq0AXyT+AGvkZwDaq1MA8J0CAO0qCADs3gcAj/T/AFHxnwBnObIAAHr0AGNgYQCyAeoAerH5ANuJsQAZnSwAqPWRABmF5gBKI5IAkQpVAOQq0gCdZxQArSpTAFC4aACZFzgA2vozAKKrjwADOGYAxejeANjGkgAogccAnJtJAHa0iQDNsMQAvkg0AAxqhQABL88A0+rRAGam/AAZaiwAakBeAIkbewAlIpIAMQjsAHKsxAAVPRIAH5HeABuShQBm4ocAtOdpAIvy0QDAdbAAnRZ2AFNL6QCFcQYACIehACvVNgChty8Ah5A8AFc4iwBQwRwAv3PeAO+FjABRt0kAMfNNAMz2/QDaFEEAzLRaAJ5hlQBihAoAP/CjAPH4bAC/fxwAPapOAO3BCQDgg2gA7IyRABgp/AAO+QgAXrMFAHPiZwDc83IAmMzHALPPaAAlyrkAAk6uAD33pwBo0iAAC56eAOolMACgdmQAKdJeAA0UPgBtua8AIH66AJMoxwCYv7UA4JcKAN5c/wDgWDwAcWbUANvmLwD73kIAu/vCAFUiCQB5CJIAxOlxADKN8AB4H8EAh8gnAC8h8QCdBUgAX7cyADXejABFCWYAm7v7AOENigCsVMYAY8UeABEpaADYLmMAOWcMANk9hAANhM8AAQHaAMfmVwB2p2AA5MbYAOw44gCKrqQADZOHAM1RlwBhnvAAGkToADueDQDmbJ0AFYYTAGE6UgDjbEgAeJhCAOOGgAC0s6QANh6iAMu3kQAMMBQAl7YOANsIXwCkd9oA8mqMANf38wCxC7EAv7gjAKa0HwCgqV4ApgI/AIe1oQBaGE8AcxcBAObgYQBMMWwA1G0gAF+J9ABkAl8A2buoAIlKWAA/ZykAl6S0ABtBMQAkyOEAzFtyAHIMdgCCfMgAG9m4ABOX7wBfi/wAeg74AELcSAC7RgEAP1V0AD/FBwABALUAdGX+APlznwBqD1MAfTHIALA+HgDRP/QAaraOANCTrgBWaVUANUQjAFVulwBFlpkAsU3sAN86OACsleQAcFHoANanugC10xgAjD4TAA0g3gDcmx4A/eNDAIsxFAC6N5UAJ7fDAFRwZQD/+pAALV5yACfwHwBzltQA9CAuAD0nQQDbjogAKLenAHydkQDwD+IABvePAF9zWAAvQBwA4Ae3AJk+hQCB0ugAHXjgAOBbKQC4/ksAP4CtAAELZgDZ6kEAO2TIAPH6ZAC80CwAd9CIANrJ3QBbk7QAcT0AAE58HwDa9QMAOYjoABoHGQArjcwADSF4AFNcRgCnkjIAsG/cAC7iCwCh3qEAramDAAYS3gBO0jcA+2p2ADpCZwATvIsAa0FuABWrbwD+0jUA+PYEAPXTnQCnvXQAYtYoAKfT2wCPsNUA0bqlAG1+sQBnnqEA7hvxABQYewBmeO4Ackj6AJhuRADlYpAA9O9TAPSSeACW+ZAAa0nLAErmuAABaxcA+WJsAAJrYgDjOEkAwldNAC3lLwDy81wAoYZzADYpmwC509wAtFJdAIFkwgDiIEsAkyBvAMmSIgDb/sgAjTw2AJzz6QA+0Z8AwXaTAD/3lwB0Kg8A63iFAFe95wARFK8AFOY5AMAmfwB+Rj4AVleaAJNp0wBDKCUAh08qAEy8BwAX0CUAs+xgABUglAD3+TAA8jt9AM83uwBUVaEAvErrACRYKgB8iGkAb5fUAP71dwDEJIoAx7wfAAIduQALb3kAjm+cABeJCADKk10AdfclABorYAC0WOgA167pAGsx/QC8htoA+7auAATccACYfLsAszNLADwo8ACOsr0AdJmfABl+xgD7MQ4Ax2x6AMpK4gBV7FkA0g/QAFmDRQA01bkAFKhtAH9PEwCEoukAV2UiAC2B+wCuwRsA560TAK92ZAABWWcAovTVAPS/6AC+1C8AXCkSAM2NegBYrWQAmozZAE2CIgBAgY4A9YmBAKY0DgD3ZLAAOgXaAOOGSwDofs8AHlvXAN204wCjH2YAlRVHAA2cxwBDjN8AwumLAC5MEwAKK9YAyELrANJYkACbtlYAKfF2AGpW8ACRmC0AWHqZAB1CzwAGY9sA0N9+AOS4igAHJNkACm+yAA+sXwBKUUIAaipZAJuECwDrgV0AFMJpAAKMjgAtdggAJYIXAHDtegAgFIoASxGoALACPgA2KPEASXlaAGIX7QAjLsYA62u0ABm8HQB5dUsATxadAK6qQwD8VEkAd1ARAFOFzADC26QAfe2GANRbdwC7nK8AEwy4AB2XrgDAHIsAZSA6AEo5AgAM8GUAth6kAINTsACbAcEAxoCEAIZGPAD4GlwA3aV9AK7CDgCjga4ArWf0AHD1VQBd2TgA+eGcABMlUACIulIAOzg4AHP9zACB2VIAkyv0ALSeowCib4MA3fyrAMP7+gBVtSMAzpdQAMFI1AATJq8ALcZ1AGvp0gC/4oMAH3/0AFPf7wB5xTwAHeDZAALL8gDOEuQA+iN+AMs3AgCP3lIAs+6FABBzswBwlFkAxPuuAEg6pgCvKoIAU9EoAGAPigBqilYACnYGADJYkQCkihkA7FTKAISADQCODaoAYE04ALH1iwAUi7MAzURTAORgwQCts3wAc78IAFkTXwB+A5UAJiRXAJFADwAjr7MAdjo6ANNvLACcXagA09XGAOzjAwC0GJ0AV3hVAI1RkwAuDVgAtcfaABkNCQAljBgABQNSABEgDQB5kmwAIre6AFs6+wAnad4AT4iAAMSvawA7Fn8AlLC9AOscDABRf54ATp8wAMzgnwD29YQASW0XAEj2NwDw2U4A9NokAMTdYQBw+5UAgxCpAEwmpwCyDPwANRUYALHKyQB5mGsA1yJ8AJqjDQCaHDEAMtJrAEvLIQCDVUoAwGn3AETZ3wCLIwEAeJNzAMkj8AAUk2wAe+YVAOVR8wDCzpcAu4jkACv7dAA3vOgApBWtAO+tkAD8tu8Ac7noACsS7QAXfvMA7mjTACJc9QCea+gAx2jFALywtACyxdUA7r2wANGY2wD4JvYAg5VOANb0ggDtytkA8WGyAHMOtwA0vqAAwO5NAJSJDAAUaRUAoDvEAIfetwA9PqoA1jC3AA61XADx70MA7fFUAPQtRgBpiV0AP2XDAKNQvgCyW6UAJ9esADvTdQBm6f4AF1lDADTKvgCXNQQA6SFtAEuSVQBsXjUAmGbSANERuABhSpUAD2OJAGLtFABRMFUA0IDAAPc3TwCtToMASSGaAMDpVwCjm40At6keAG6chAAgkRAAz7GGAG8lHQA7qgwA8BucAMnEEQDEC+4A9g4MALMwnwAEFpMAqzf0AK8BoAA6L6sA0l0OACWT/gCVqp8AfumWABzjDQCtsygAHG0JAHebagCmi2EAztDRALUodwCq1+sAEcGyAGmDQQAVnXMAxMu8APC5wACRds0AzdJ4AEUdzwD/LLAAUdAQADW6IQBIUcUAXGxOAHdGZAARzd8AA7Y5ADE7cABegAcA0eDuAMBHYwA6skcARPfCAEYMxwB2/g8APBr5AFNusABVe1kAw4+OAOxwgwB7LiwAOltxAI0eAwALkk4AG9EZAESUzgD9fdQA4YOFAJVkHACkj4MAsWJxABeFJABHocwATeLwAG+OuQDdhzIAabHNAPogKwCTMKQAkanLAAsZLQDFv6YAXjQFAK1LdwDK4XsAcM7eAGCurgA7dq8AgD8dAHK87QDpwi8AwH3WAM/BcgBW7sAAyUeVAGw91wCHzM8Aa5fYABuR9QBhOk8Ay+OSAGYDiwAHCJAAYjifABxdQABItm0Ame2tAE/4XABIC6sA0aPxAAwi2ACitbQAtsWpAA+jPwB2lCgAqaATAMx3JADF2o4A6fhSABNVmwC6giQAYfj6AD0dkwBkmecAU5sTANWMgwD7D+cAp9QWAI6+QQAkZvcAkvGvAMaNOgAtsuEAF+LgADEdxgDAc9MA7+36APqe/wD41wQAIIDKAHsx1gATEKgAnWdaAFgB0wAyMAEAxTsPADTrDACBAuMALov9APMo1wB1wawAlCj7AP3EbAD1lDQA3xUvAAPdwABvPXQAwPeDAGxwkQAaAUEAbJQ2ACGgEQBn8XAAuu81AKaQhgAzfIQAkp8jADQ4TQBSSaIALjCgAJuAjQBP8AsAHL5SAKmH7ACyx5cAP/VjAG71zgCuL+IAV2JLAN+yFgA7QvgAG0HdAFO6AwCx+AwArlawAB83cABUNtcAe9LbACB2gAAZVTUA4DRYAEFV4wByz2QAWUgkALXS9ACCaEYAxjjiAI0qiAArChIAr7twAPvaOwDhyfkAEoYVAIM5KABarEsAol47AIBNdQDfMHQAN8GNADM6XwBbJFMAMAEbALILpgCxRIsA3mxlAGqpZACd9SkA9uwTABtT4ABUZDIA3cxyAGnKygA3zW4Age3TANrX0QBc2KEAAab2AEQksQDabWAAdmSYAOBdUwDsLkgAOa4fAPi45QAjr5gAZvEs"
+ var audio=new Audio(src)
+ audio.onended = finish;
+ audio.onerror = finish;
+ try{audio.play()}catch(e){}
+ try{audio.preload=1}catch(e){}
+ try{audio.muted=1}catch(e){}
+ try{audio.playbackRate=567312.2079031984}catch(e){}
+ </script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1517199.html b/dom/media/test/crashtests/1517199.html
new file mode 100644
index 0000000000..10c994f845
--- /dev/null
+++ b/dom/media/test/crashtests/1517199.html
@@ -0,0 +1,17 @@
+<html class="reftest-wait">
+<head>
+<script>
+(async _ => {
+ const video = document.createElement("video");
+ video.mozCaptureStreamUntilEnded();
+ video.src = "test.mp4";
+ video.playbackRate = 2;
+ await new Promise(r => video.onloadedmetadata = r);
+ video.currentTime = video.duration - 1;
+ await video.play();
+ await new Promise(r => video.onended = r);
+ document.documentElement.removeAttribute("class");
+})();
+</script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1526044.html b/dom/media/test/crashtests/1526044.html
new file mode 100644
index 0000000000..1914dfc2f5
--- /dev/null
+++ b/dom/media/test/crashtests/1526044.html
@@ -0,0 +1,19 @@
+<script>
+ function start () {
+ try { o1 = new AudioContext({}) } catch (e) { }
+ try { o2 = new DynamicsCompressorNode(o1, {}) } catch (e) { }
+ try { o3 = o2.attack } catch (e) { }
+ try { o4 = new XMLHttpRequest({mozAnon: true, mozSystem: true}) } catch (e) { }
+ try { o4.open('GET', '', false) } catch (e) { }
+ try { o4.send() } catch (e) { }
+ for (let i = 0; i < 20; i++) {
+ try { o5 = o1.createGain() } catch (e) { }
+ try { o1.suspend().then(function () { }) } catch (e) { }
+ try { o5.connect(o3) } catch (e) { }
+ }
+ setTimeout('location.reload()', 200)
+ }
+
+ window.addEventListener('load', start)
+</script>
+
diff --git a/dom/media/test/crashtests/1530897.webm b/dom/media/test/crashtests/1530897.webm
new file mode 100644
index 0000000000..ac2224157a
--- /dev/null
+++ b/dom/media/test/crashtests/1530897.webm
Binary files differ
diff --git a/dom/media/test/crashtests/1538727.html b/dom/media/test/crashtests/1538727.html
new file mode 100644
index 0000000000..6371d54383
--- /dev/null
+++ b/dom/media/test/crashtests/1538727.html
@@ -0,0 +1,14 @@
+<script>
+const canvas = document.createElement('canvas')
+const context = canvas.getContext('2d', {})
+const xhr = new XMLHttpRequest({})
+const stream = canvas.captureStream(new Float64Array([1593177632.1689904])[0])
+recorder = new MediaRecorder(stream)
+recorder.start(100)
+xhr.open('G', '', false)
+xhr.send()
+recorder.stop()
+tracks = stream.getVideoTracks()
+track = tracks[(1051736525 % tracks.length)]
+stream.removeTrack(track)
+</script>
diff --git a/dom/media/test/crashtests/1545133.html b/dom/media/test/crashtests/1545133.html
new file mode 100644
index 0000000000..fb7039aae3
--- /dev/null
+++ b/dom/media/test/crashtests/1545133.html
@@ -0,0 +1,34 @@
+<html class="reftest-wait">
+<head>
+<script>
+const xhr = new XMLHttpRequest()
+
+async function boom () {
+ await new Promise(r => setTimeout(r, 100))
+
+ SpecialPowers.forceCC()
+ SpecialPowers.forceCC()
+ SpecialPowers.forceCC()
+
+ document.documentElement.removeAttribute("class")
+}
+
+function start () {
+ const context = new AudioContext({})
+ const filter = new BiquadFilterNode(context, {})
+ const destination = context.createMediaStreamDestination()
+ const processor = context.createScriptProcessor(8192, 8, 8)
+ processor.connect(filter.Q)
+ processor.disconnect()
+ xhr.open('G', '', false)
+ xhr.send()
+ context.createMediaStreamSource(destination.stream)
+ processor.connect(filter.Q)
+ context.close()
+ context.addEventListener('statechange', boom, true)
+}
+
+document.addEventListener('DOMContentLoaded', start)
+</script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1547784.html b/dom/media/test/crashtests/1547784.html
new file mode 100644
index 0000000000..ee270491f1
--- /dev/null
+++ b/dom/media/test/crashtests/1547784.html
@@ -0,0 +1,33 @@
+<html class="reftest-wait">
+<head>
+ <script>
+ const doc = new Document();
+ const video = document.createElementNS('http://www.w3.org/1999/xhtml', 'video');
+ const source = new MediaSource();
+
+ navigator.requestMediaKeySystemAccess('org.w3.clearkey', [{ '': [{ '': '' }] }])
+ .then(keySystemAccess => {
+ return keySystemAccess.createMediaKeys();
+ }).then(_ => {
+ video.src = URL.createObjectURL(source);
+ source.addEventListener('sourceopen', () => {
+ doc.adoptNode(video);
+ });
+ });
+
+ navigator.requestMediaKeySystemAccess('org.w3.clearkey', [{ '': [{ '': '' }] }])
+ .then(keySystemAccess => {
+ return keySystemAccess.createMediaKeys();
+ }).then(mediaKeys => {
+ return video.setMediaKeys(mediaKeys);
+ }).then(() => {
+ video.src = URL.createObjectURL(source);
+ document.documentElement.removeAttribute("class");
+ }).catch(e => {
+ // Catch JS errors caused by raciness in the test. So long as we're
+ // not crashing we're good.
+ document.documentElement.removeAttribute("class");
+ });
+ </script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1547899.html b/dom/media/test/crashtests/1547899.html
new file mode 100644
index 0000000000..4ffd90c565
--- /dev/null
+++ b/dom/media/test/crashtests/1547899.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+ <script>
+ function start () {
+ const video = document.getElementById('id_0')
+ const stream_1 = new MediaStream()
+ const stream_2 = video.mozCaptureStreamUntilEnded()
+ const track = stream_2.getTracks()[0]
+
+ video.srcObject = stream_1
+ stream_1.addTrack(track)
+ }
+
+ window.addEventListener('load', start)
+ </script>
+</head>
+<body>
+<video id="id_0" src="data:audio/mpeg;base64,ZQr/+1DEAAAAAAAAAAAAAAAAAAAAAABJbmZvAAAADwAAAAsAAAnKABcXFxcXFxcXFy4uLi4uLi4uLkVFRUVFRUVFRV1dXV1dXV1dXXR0dHR0dHR0dIuLi4uLi4uLi6KioqKioqKiorq6urq6urq6utHR0dHR0dHR0ejo6Ojo6Ojo6P///////////wAAADlMQU1FMy45OHIBpQAAAAAuHQAAFEAkBElCAABAAAAJyuGI2MQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA//tQxAAABmQjXHSRAAH6IfB3OVIDAADLlmjIxWKxWTyIABgmGydGjRox4f8Tg+D4OAgc/BwEDn+UBD+qwH/+8Tny7///KO4IYDgcDgcDgcDgcCgQAAAKKBUFc/nnP30a5O0zyYzMNMkzKlPva2GXgMIBbwDQEAYDQNXGLT2EIgEhoFnQNDb4BAPD9wTFYGJBWJw/8AUWgMBQgIEg4KmAKGP/wRG0csCIWDaQxcFhYvv/8WYMUpEIkXhvnRef//kmsuLPH5OvSoAFKxrJIm26DP/7UsQ">
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1560215.html b/dom/media/test/crashtests/1560215.html
new file mode 100644
index 0000000000..1b76e218d7
--- /dev/null
+++ b/dom/media/test/crashtests/1560215.html
@@ -0,0 +1,20 @@
+<html class="reftest-wait">
+<head>
+ <script>
+ async function start () {
+ const canvas = document.createElement('canvas')
+ const context = canvas.getContext('2d')
+ context.fillStyle = "red"
+ context.fillRect(0, 0, 1, 1)
+ const recorder = new MediaRecorder(
+ canvas.captureStream(), { videoBitsPerSecond: 16 })
+ recorder.start(100)
+ await new Promise(r => recorder.onstart = r)
+ recorder.pause()
+ document.documentElement.removeAttribute("class")
+ }
+
+ window.addEventListener('load', start)
+ </script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1569645.html b/dom/media/test/crashtests/1569645.html
new file mode 100644
index 0000000000..b1f1247f26
--- /dev/null
+++ b/dom/media/test/crashtests/1569645.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+ <script>
+ function start () {
+ const canvas = document.getElementById("c")
+ canvas.getContext("2d")
+ const video = canvas.captureStream()
+ const ac = new AudioContext()
+ const dest = ac.createMediaStreamDestination()
+ const recorder = new MediaRecorder(
+ new MediaStream([...video.getTracks(), ...dest.stream.getTracks()]), {
+ 'mimeType': 'audio/ogg'
+ })
+ recorder.start()
+ }
+
+ window.addEventListener('load', start)
+ </script>
+</head>
+<body>
+<canvas id="c"></canvas>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1575271.html b/dom/media/test/crashtests/1575271.html
new file mode 100644
index 0000000000..ceda986553
--- /dev/null
+++ b/dom/media/test/crashtests/1575271.html
@@ -0,0 +1,25 @@
+<html class="reftest-wait">
+<head>
+<script>
+ async function start () {
+ const canvas = document.createElement("canvas")
+ const context = canvas.getContext("2d")
+ context.fillStyle = "blue"
+ context.fillRect(0, 0, canvas.width, canvas.height)
+ const stream = canvas.captureStream()
+ const track = stream.getTracks()[0]
+ const recorder = new MediaRecorder(stream)
+ recorder.start()
+ await new Promise(r => recorder.onstart = r)
+ recorder.pause()
+ stream.removeTrack(track)
+ recorder.resume()
+ await new Promise(r => recorder.onstop = r)
+ document.documentElement.removeAttribute("class")
+ }
+
+ window.addEventListener('load', start)
+</script>
+</head>
+</html>
+
diff --git a/dom/media/test/crashtests/1577184.html b/dom/media/test/crashtests/1577184.html
new file mode 100644
index 0000000000..a38c4a1265
--- /dev/null
+++ b/dom/media/test/crashtests/1577184.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+<script>
+function start () {
+ const frame = document.createElementNS('http://www.w3.org/1999/xhtml', 'frame')
+ document.documentElement.appendChild(frame)
+ frame.contentWindow.eval('window.top.context=new AudioContext()')
+ document.documentElement.innerHTML = ''
+ context.createMediaElementSource(new Audio(''))
+}
+
+document.addEventListener('DOMContentLoaded', start)
+</script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1587248.html b/dom/media/test/crashtests/1587248.html
new file mode 100644
index 0000000000..10c555e2b1
--- /dev/null
+++ b/dom/media/test/crashtests/1587248.html
@@ -0,0 +1,23 @@
+<html class="reftest-wait">
+<head>
+<script>
+function start () {
+ const audio = document.getElementById('id_4')
+ const doc = new Document()
+ const stream = new MediaStream()
+ const track = document.createElementNS('http://www.w3.org/1999/xhtml', 'track')
+ audio.srcObject = stream
+ track.textContent = '�'
+ setTimeout(() => {
+ track.replaceChild(audio, track.childNodes[0])
+ audio.play().then(function (arg4) { })
+ document.documentElement.removeAttribute("class")
+ }, 157)
+ doc.adoptNode(audio)
+}
+
+document.addEventListener('DOMContentLoaded', start)
+</script>
+</head>
+<audio class="" id="id_4" itemscope></audio>
+</html>
diff --git a/dom/media/test/crashtests/1594466.html b/dom/media/test/crashtests/1594466.html
new file mode 100644
index 0000000000..276c5fe3d1
--- /dev/null
+++ b/dom/media/test/crashtests/1594466.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+<script>
+function start() {
+ const ac = new AudioContext();
+ const {stream: audioStream} = ac.createMediaStreamDestination();
+ const [audioTrack] = audioStream.getTracks();
+ const canvas = document.createElement("canvas");
+ const ctx = canvas.getContext("2d");
+ const [videoTrack] = canvas.captureStream().getTracks();
+
+ const rec = new MediaRecorder(new MediaStream([audioTrack, videoTrack]), {
+ mimeType: 'video/webm; codecs="vp8, opus"'
+ });
+ rec.start();
+}
+
+document.addEventListener('DOMContentLoaded', start)
+</script>
+</head>
+</html>
+
diff --git a/dom/media/test/crashtests/1601385.html b/dom/media/test/crashtests/1601385.html
new file mode 100644
index 0000000000..7192809076
--- /dev/null
+++ b/dom/media/test/crashtests/1601385.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+<script>
+const video = document.createElement("video");
+video.srcObject = new MediaStream();
+video.mozCaptureStreamUntilEnded();
+video.src = "sound.ogg";
+video.srcObject = undefined;
+</script>
+</head>
+</html>
+
diff --git a/dom/media/test/crashtests/1601422.html b/dom/media/test/crashtests/1601422.html
new file mode 100644
index 0000000000..9ff3c1a07a
--- /dev/null
+++ b/dom/media/test/crashtests/1601422.html
@@ -0,0 +1,20 @@
+<html class="reftest-wait">
+<head>
+<script>
+(async _ => {
+ try {
+ const video = document.createElement('video')
+ video.preload = 'metadata'
+ video.src = 'sound.ogg'
+ await new Promise(r => video.onloadedmetadata = r)
+ const stream_1 = video.mozCaptureStreamUntilEnded()
+ video.src = ''
+ const stream_2 = video.mozCaptureStreamUntilEnded()
+ } finally {
+ document.documentElement.removeAttribute("class")
+ }
+})()
+</script>
+</head>
+</html>
+
diff --git a/dom/media/test/crashtests/1604941.html b/dom/media/test/crashtests/1604941.html
new file mode 100644
index 0000000000..5a9265ea1b
--- /dev/null
+++ b/dom/media/test/crashtests/1604941.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+async function boom()
+{
+ await SpecialPowers.pushPrefEnv({"set": [
+ ["media.cubeb.force_null_context", true],
+ ]});
+ new Audio().mozCaptureStreamUntilEnded();
+ var ac = new window.AudioContext();
+ ac.resume();
+ ac.close();
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
+
diff --git a/dom/media/test/crashtests/1608286.html b/dom/media/test/crashtests/1608286.html
new file mode 100644
index 0000000000..9f52605be6
--- /dev/null
+++ b/dom/media/test/crashtests/1608286.html
@@ -0,0 +1,50 @@
+<html class="reftest-wait">
+<head>
+ <script>
+ function test() {
+ function checkResolve(value) {
+ // Let the test timeout and fail
+ throw new Error("This promise should not resolve");
+ }
+
+ function checkReject(reason) {
+ if (reason.message !== "Browsing context is no longer available") {
+ // Let the test timeout and fail
+ throw new Error("Unexpected rejected promise reason");
+ }
+ // Otherwise, successfully rejected a request not attached to a
+ // window without crashing
+ }
+
+ var i = document.querySelector("iframe");
+ var nav = i.contentWindow.navigator;
+ i.remove();
+
+ // First, check with valid args
+ nav.requestMediaKeySystemAccess(
+ "com.widevine.alpha",
+ [{
+ initDataTypes: ["webm"],
+ videoCapabilities: [{ contentType: 'video/webm; codecs="vp9"' }]
+ }]
+ ).then(
+ checkResolve,
+ (reason) => {
+ checkReject(reason);
+
+ // Then, check with invalid args
+ nav.requestMediaKeySystemAccess("", []).then(
+ checkResolve,
+ (reason) => {
+ checkReject(reason);
+ document.documentElement.removeAttribute("class");
+ }
+ );
+ });
+ }
+ </script>
+</head>
+<body onload="test()">
+ <iframe></iframe>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1673525.html b/dom/media/test/crashtests/1673525.html
new file mode 100644
index 0000000000..51de202999
--- /dev/null
+++ b/dom/media/test/crashtests/1673525.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+ <script>
+ document.addEventListener("DOMContentLoaded", () => {
+ const audio = document.getElementById("audio");
+ audio.autoplay = true;
+ audio.mozCaptureStream();
+ })
+ </script>
+</head>
+<body>
+ <!-- The data URL is crafted from a fuzzed mp3 so the base64 can be decoded back to an mp3 as needed -->
+ <audio id="audio" src="data:audio/mpeg;base64,//tQxAAAAAAAAAAAAAAAAAAAAAAASW5mbwAAAA8AAAALAAAJygAXFxcXFxcXFxcuLi4uLi4uLi5FRUVFRUVFRUVdXV1dXV1dXV10dHR0dHR0dHSLi4uLi4uLi4uioqKioqKioqK6urq6urq6urrR0dHR0dHR0dHo6Ojo6Ojo6Oj///////////8AAAA5TEFNRTMuOThyAaUAAAAALh0AABRAJARJQgAAQAAACcrhiNjEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP/7UMQAAAZkI1x0kQAB+iHwdzlSAwAAy5ZoyMVisVk8iAAYJhsnRo0aMeH/E4Pg+DgIHPwcBA5/lAQ/qsB//vE58u///yjuCGA4HA4HA4HA4HAoEAAACigVBXP55z99GuTtM8mMzDTJMypT72thl4DCAW8A0BAGA0DVxi09hCIBIaBZ0DQ2+AQDw/cExWBiQVicP/AFFoDAUICBIOCpgChj/8ERtHLAiFg2kMXBYWL7//FmDFKRCJF4b50Xn//5JrLizx+Tr0qABSsaySJtugz/+1LEBIALgQmLvLUAMXkorjzSjuWd/+FbPOduga79Dhef0OFYNhp+FEPDPRyRvOEERl/Uwbv9F/UuQN5yt9WPM5xwqlB4+hzmfmoYmcceWPD8s3WA8FhYEPkhR0SgMHw="></audio>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1673526-1.html b/dom/media/test/crashtests/1673526-1.html
new file mode 100644
index 0000000000..925dbae6ab
--- /dev/null
+++ b/dom/media/test/crashtests/1673526-1.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+<script>
+window.addEventListener('load', async () => {
+ const frame = document.createElement('frame')
+ document.documentElement.appendChild(frame)
+ const pc = new RTCPeerConnection({})
+ await pc.createOffer({ 'offerToReceiveAudio': true })
+ const [{receiver}] = pc.getTransceivers()
+ const track = pc.addTrack(receiver.track)
+ pc.removeTrack(track)
+ const [track2] = (await frame.contentWindow.navigator.mediaDevices.getUserMedia({
+ 'audio': {},
+ 'fake': true
+ })).getTracks()
+ pc.addTrack(track2)
+})
+</script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1673526-2.html b/dom/media/test/crashtests/1673526-2.html
new file mode 100644
index 0000000000..ddae9520fc
--- /dev/null
+++ b/dom/media/test/crashtests/1673526-2.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+<script>
+window.addEventListener('load', async () => {
+ const frame = document.createElement('frame')
+ document.documentElement.appendChild(frame)
+ const pc = new RTCPeerConnection({})
+ await pc.createOffer({ 'offerToReceiveAudio': true })
+ const [{sender, receiver}] = pc.getTransceivers()
+ await sender.replaceTrack(receiver.track)
+ await sender.replaceTrack(null)
+ const stream = await frame.contentWindow.navigator.mediaDevices.getUserMedia({
+ 'audio': {},
+ 'fake': true
+ })
+ await sender.replaceTrack(stream.getTracks()[0])
+})
+</script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1693043.html b/dom/media/test/crashtests/1693043.html
new file mode 100644
index 0000000000..f73323bbd7
--- /dev/null
+++ b/dom/media/test/crashtests/1693043.html
@@ -0,0 +1,21 @@
+<html class="reftest-wait">
+<head>
+<script>
+async function boom() {
+ const audio = document.createElement("audio");
+ audio.preload = "metadata";
+ audio.src = "sound.ogg";
+ await new Promise(r => audio.onloadedmetadata = r);
+ const s = audio.mozCaptureStream();
+ const recorder = new MediaRecorder(
+ new MediaStream(s.getTracks()),
+ { audioBitsPerSecond: 3994678619 }
+ );
+ recorder.start();
+ document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body onload="boom()">
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1696511.html b/dom/media/test/crashtests/1696511.html
new file mode 100644
index 0000000000..de66fa3a67
--- /dev/null
+++ b/dom/media/test/crashtests/1696511.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html class='reftest-wait'>
+<head>
+<script>
+document.addEventListener('DOMContentLoaded', async () => {
+ const canvas = document.createElement('canvas')
+ canvas.height = 27530
+ const context = canvas.getContext('2d')
+ context.strokeRect(5, 5, canvas.width - 5, canvas.height - 5)
+ const stream = canvas.captureStream()
+ const recorder = new MediaRecorder(stream)
+ recorder.start()
+ const stopped = new Promise(r => recorder.onstop = r)
+ await new Promise(r => setTimeout(r, 100))
+ stream.getTracks().forEach(t => t.stop())
+ await stopped
+ document.documentElement.removeAttribute("class")
+})
+</script>
+</head>
+</html>
+
diff --git a/dom/media/test/crashtests/1697521.html b/dom/media/test/crashtests/1697521.html
new file mode 100644
index 0000000000..b44c02e227
--- /dev/null
+++ b/dom/media/test/crashtests/1697521.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+<script>
+async function boom() {
+ const canvas = document.createElement("canvas");
+ canvas.getContext("2d");
+ const recorder = new MediaRecorder(new MediaStream([
+ ...canvas.captureStream().getTracks(),
+ ...canvas.captureStream().getTracks(),
+ ]));
+ recorder.start();
+ recorder.requestData();
+}
+</script>
+</head>
+<body onload="boom()">
+</body>
+</html>
+
diff --git a/dom/media/test/crashtests/1708790.html b/dom/media/test/crashtests/1708790.html
new file mode 100644
index 0000000000..ee97a31c81
--- /dev/null
+++ b/dom/media/test/crashtests/1708790.html
@@ -0,0 +1,22 @@
+<html class="reftest-wait">
+<head>
+<script>
+(async _ => {
+ try {
+ const audio = document.createElement('audio');
+ audio.src = 'sound.ogg';
+ const ac = new AudioContext();
+ const src = ac.createMediaElementSource(audio);
+ src.connect(ac.destination);
+ await audio.play();
+ audio.pause();
+ audio.volume = 0.5;
+ audio.playbackRate = 0.5;
+ audio.preservesPitch = false;
+ } finally {
+ document.documentElement.removeAttribute("class")
+ }
+})()
+</script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1709130.html b/dom/media/test/crashtests/1709130.html
new file mode 100644
index 0000000000..2c6d7dc690
--- /dev/null
+++ b/dom/media/test/crashtests/1709130.html
@@ -0,0 +1,19 @@
+<html class="reftest-wait">
+<head>
+<script>
+(async _ => {
+ const video = document.createElement("video");
+ video.mozCaptureStreamUntilEnded();
+ video.src = "test.mp4";
+ await video.play();
+ for (let i = 0; i < 23; i++) {
+ console.log("nop");
+ await video.seekToNextFrame();
+ video.removeAttribute("readonly");
+ }
+ setTimeout("self.close()", 100);
+ document.documentElement.removeAttribute("class");
+})();
+</script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1734008.html b/dom/media/test/crashtests/1734008.html
new file mode 100644
index 0000000000..31c8d31dae
--- /dev/null
+++ b/dom/media/test/crashtests/1734008.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script>
+ window.addEventListener("load", async () => {
+ const object = document.createElementNS("http://www.w3.org/2000/svg", "foreignObject")
+ const video = document.createElementNS("http://www.w3.org/1999/xhtml", "video")
+ document.documentElement.appendChild(video)
+ video.setAttribute("src", "1734008.webm")
+ video.mozCaptureStream()
+ const xhr = new XMLHttpRequest()
+ xhr.open("POST", "FOOBAR", false)
+ xhr.send()
+ const document_0 = new Document()
+ const adopted = document_0.adoptNode(document.documentElement)
+ object.insertBefore(adopted, object.childNodes[(216679474 % object.childNodes.length)])
+ try { await video.play() } catch (e) {}
+ setTimeout("location.reload()", 500)
+ })
+ </script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1734008.webm b/dom/media/test/crashtests/1734008.webm
new file mode 100644
index 0000000000..07d2052879
--- /dev/null
+++ b/dom/media/test/crashtests/1734008.webm
Binary files differ
diff --git a/dom/media/test/crashtests/1741677.html b/dom/media/test/crashtests/1741677.html
new file mode 100644
index 0000000000..0c442e830d
--- /dev/null
+++ b/dom/media/test/crashtests/1741677.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<html class="reftest-wait">
+<script>
+ const script = `
+ navigator.mediaCapabilities.decodingInfo({
+ type: 'file',
+ audio: { contentType: "audio/flac" }
+ }).then(postMessage("done"));
+ `;
+ let worker = new Worker(URL.createObjectURL(new Blob([script])));
+ // Stop test completion and crash from racing each other.
+ worker.onmessage = () => document.documentElement.removeAttribute("class");
+</script>
+</html>
diff --git a/dom/media/test/crashtests/1748272.html b/dom/media/test/crashtests/1748272.html
new file mode 100644
index 0000000000..53953e7c0e
--- /dev/null
+++ b/dom/media/test/crashtests/1748272.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script>
+ window.addEventListener("load", () => {
+ const audio = new Audio();
+ const context = new AudioContext({ "sampleRate": 15772.7 })
+ context.createMediaElementSource(audio);
+ });
+ </script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1752917.html b/dom/media/test/crashtests/1752917.html
new file mode 100644
index 0000000000..84752a174f
--- /dev/null
+++ b/dom/media/test/crashtests/1752917.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script>
+ window.addEventListener("load", () => {
+ const context = new AudioContext({})
+ const node = new DelayNode(context, {})
+ const abort = new AbortController()
+ let processor = context.createScriptProcessor(4096, 1, 26)
+ processor.addEventListener("audioprocess", () => {}, { "signal": abort.signal })
+ processor.connect(node.delayTime)
+ processor = undefined
+ SpecialPowers.forceGC()
+ abort.abort(undefined)
+ });
+ </script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1762620.html b/dom/media/test/crashtests/1762620.html
new file mode 100644
index 0000000000..b4c705c84f
--- /dev/null
+++ b/dom/media/test/crashtests/1762620.html
@@ -0,0 +1,8 @@
+<audio id='fuzzed' controls>
+ <source src='fuzzed.wav'>
+</audio>
+<script>
+ var m = document.getElementById('fuzzed')
+ m.addEventListener('canplay', m.play, true)
+</script>
+
diff --git a/dom/media/test/crashtests/1765842.html b/dom/media/test/crashtests/1765842.html
new file mode 100644
index 0000000000..8b77ec998a
--- /dev/null
+++ b/dom/media/test/crashtests/1765842.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+ <video src="1765842.webm" type="video/webm" autoplay="true" controls></video>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1765842.webm b/dom/media/test/crashtests/1765842.webm
new file mode 100644
index 0000000000..62eb5d779d
--- /dev/null
+++ b/dom/media/test/crashtests/1765842.webm
Binary files differ
diff --git a/dom/media/test/crashtests/1787281.html b/dom/media/test/crashtests/1787281.html
new file mode 100644
index 0000000000..e5586dbf2f
--- /dev/null
+++ b/dom/media/test/crashtests/1787281.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+</head>
+<body>
+ <video id=a src="1787281.mp4" autoplay="true" controls></video>
+ <script>
+ a.onended = function() {
+ document.documentElement.className = "";
+ }
+ </script>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/1787281.mp4 b/dom/media/test/crashtests/1787281.mp4
new file mode 100644
index 0000000000..8481cf034c
--- /dev/null
+++ b/dom/media/test/crashtests/1787281.mp4
Binary files differ
diff --git a/dom/media/test/crashtests/1798778.html b/dom/media/test/crashtests/1798778.html
new file mode 100644
index 0000000000..300d84afa1
--- /dev/null
+++ b/dom/media/test/crashtests/1798778.html
@@ -0,0 +1,11 @@
+<html class="reftest-wait">
+<head>
+<audio id=a src="adts-truncated.aac" controls></audio>
+<script>
+ a.play();
+ a.onerror = function() {
+ document.documentElement.removeAttribute("class");
+ }
+</script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/1833894.mp4 b/dom/media/test/crashtests/1833894.mp4
new file mode 100644
index 0000000000..a5c20e4846
--- /dev/null
+++ b/dom/media/test/crashtests/1833894.mp4
Binary files differ
diff --git a/dom/media/test/crashtests/1833896.mp4 b/dom/media/test/crashtests/1833896.mp4
new file mode 100644
index 0000000000..6d40590c8a
--- /dev/null
+++ b/dom/media/test/crashtests/1833896.mp4
Binary files differ
diff --git a/dom/media/test/crashtests/1835164.html b/dom/media/test/crashtests/1835164.html
new file mode 100644
index 0000000000..702e082954
--- /dev/null
+++ b/dom/media/test/crashtests/1835164.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<audio id=a src=1835164.opus controls autoplay></audio>
+<script>
+a.onloadedmetadata = function() {
+ a.currentTime = 1e40;
+ a.play();
+}
+a.onplaying = function() {
+ document.documentElement.removeAttribute("class");
+}
+</script>
+</html>
diff --git a/dom/media/test/crashtests/1835164.opus b/dom/media/test/crashtests/1835164.opus
new file mode 100644
index 0000000000..124fdbfda1
--- /dev/null
+++ b/dom/media/test/crashtests/1835164.opus
Binary files differ
diff --git a/dom/media/test/crashtests/1840002.webm b/dom/media/test/crashtests/1840002.webm
new file mode 100644
index 0000000000..0ad6d513e7
--- /dev/null
+++ b/dom/media/test/crashtests/1840002.webm
Binary files differ
diff --git a/dom/media/test/crashtests/1845350.mp4 b/dom/media/test/crashtests/1845350.mp4
new file mode 100644
index 0000000000..e22af449c2
--- /dev/null
+++ b/dom/media/test/crashtests/1845350.mp4
Binary files differ
diff --git a/dom/media/test/crashtests/255ch.wav b/dom/media/test/crashtests/255ch.wav
new file mode 100644
index 0000000000..d9ee36d5bf
--- /dev/null
+++ b/dom/media/test/crashtests/255ch.wav
Binary files differ
diff --git a/dom/media/test/crashtests/459439-1.html b/dom/media/test/crashtests/459439-1.html
new file mode 100644
index 0000000000..7bb0131d51
--- /dev/null
+++ b/dom/media/test/crashtests/459439-1.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+var i = 0;
+function boom()
+{
+ var div = document.getElementById("div");
+ var audio = document.getElementById("audio");
+
+ audio.onload = null;
+
+ div.textContent = "FAIL";
+ audio.src += "";
+ div.textContent = "PASS?";
+
+ ++i;
+
+ setTimeout(done, 1);
+}
+
+function done()
+{
+ // Note we reset 'src' to release decoder resources and cubeb streams to
+ // prevent OOM or OpenCubeb() failures.
+ var audio = document.getElementById("audio");
+ audio.src = "";
+ document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body>
+<audio id="audio" autoplay src="sound.ogg" oncanplaythrough="setTimeout(boom, 1);"></audio>
+<div id="div"></div>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/466607-1.html b/dom/media/test/crashtests/466607-1.html
new file mode 100644
index 0000000000..e154223efe
--- /dev/null
+++ b/dom/media/test/crashtests/466607-1.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.body.appendChild(document.createElementNS("bar", "audio"));
+ document.body.appendChild(document.createElementNS("bar", "video"));
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/media/test/crashtests/466945-1.html b/dom/media/test/crashtests/466945-1.html
new file mode 100644
index 0000000000..ac1ba29e36
--- /dev/null
+++ b/dom/media/test/crashtests/466945-1.html
@@ -0,0 +1,25 @@
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+
+var s;
+
+function boom()
+{
+ s = document.createElement("span");
+ s.innerHTML = "<video src='data:text/html,' autoplay='autoplay'><\/video>";
+ document.body.appendChild(document.createElement("iframe"));
+ setTimeout(boom2, 0);
+}
+
+function boom2()
+{
+ s.innerHTML = "";
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 0);"></body>
+</html>
diff --git a/dom/media/test/crashtests/468763-1.html b/dom/media/test/crashtests/468763-1.html
new file mode 100644
index 0000000000..d21e5bc388
--- /dev/null
+++ b/dom/media/test/crashtests/468763-1.html
@@ -0,0 +1 @@
+<html><head></head><body><video src="nosuchprotocol:"></video></body></html> \ No newline at end of file
diff --git a/dom/media/test/crashtests/474744-1.html b/dom/media/test/crashtests/474744-1.html
new file mode 100644
index 0000000000..8a7c70cf05
--- /dev/null
+++ b/dom/media/test/crashtests/474744-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.body.innerHTML += "<video src='aim:yaz'><\/video>";
+}
+
+</script>
+</head>
+<body onload="boom();">
+</body>
+</html>
diff --git a/dom/media/test/crashtests/481136-1.html b/dom/media/test/crashtests/481136-1.html
new file mode 100644
index 0000000000..bd264058d9
--- /dev/null
+++ b/dom/media/test/crashtests/481136-1.html
@@ -0,0 +1,3 @@
+<html>
+<div><object data='sound.ogg'></div>
+</html>
diff --git a/dom/media/test/crashtests/492286-1.xhtml b/dom/media/test/crashtests/492286-1.xhtml
new file mode 100644
index 0000000000..627ac38723
--- /dev/null
+++ b/dom/media/test/crashtests/492286-1.xhtml
@@ -0,0 +1 @@
+<source xmlns="http://www.w3.org/1999/xhtml"/> \ No newline at end of file
diff --git a/dom/media/test/crashtests/493915-1.html b/dom/media/test/crashtests/493915-1.html
new file mode 100644
index 0000000000..2a6ae9bd6c
--- /dev/null
+++ b/dom/media/test/crashtests/493915-1.html
@@ -0,0 +1,18 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ s = document.createElement("span");
+ a = document.createElement("audio");
+ a['src'] = "javascript:4";
+ a['loopend'] = 3;
+ s.appendChild(a);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/media/test/crashtests/495794-1.html b/dom/media/test/crashtests/495794-1.html
new file mode 100644
index 0000000000..2db69206a1
--- /dev/null
+++ b/dom/media/test/crashtests/495794-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+ <body>
+ <audio src="495794-1.ogg" autoplay onended="this.src=''; document.documentElement.className=undefined"></audio>
+ <!-- Note we reset 'src' to release decoder resources and cubeb streams to prevent OOM or OpenCubeb() failures. -->
+ </body>
+</html>
+
diff --git a/dom/media/test/crashtests/495794-1.ogg b/dom/media/test/crashtests/495794-1.ogg
new file mode 100644
index 0000000000..1c19a64061
--- /dev/null
+++ b/dom/media/test/crashtests/495794-1.ogg
Binary files differ
diff --git a/dom/media/test/crashtests/497734-1.xhtml b/dom/media/test/crashtests/497734-1.xhtml
new file mode 100644
index 0000000000..6df055da39
--- /dev/null
+++ b/dom/media/test/crashtests/497734-1.xhtml
@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+
+ div = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+ div.appendChild(document.getElementById("v"));
+ document.body.appendChild(div);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<video id="v"><source></source></video>
+
+</body>
+</html>
diff --git a/dom/media/test/crashtests/497734-2.html b/dom/media/test/crashtests/497734-2.html
new file mode 100644
index 0000000000..990ac4af46
--- /dev/null
+++ b/dom/media/test/crashtests/497734-2.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<script>
+
+function boom()
+{
+ audio1 = document.createElement("audio");
+ (audio1).appendChild(document.createElement("source"));
+ (audio1).appendChild(document.createElement("source"));
+ setTimeout(function() {
+ audio2 = document.createElement("audio");
+ audio2.appendChild(audio1);
+ }, 100);
+}
+
+</script>
+<body onload="boom();"></body>
diff --git a/dom/media/test/crashtests/576612-1.html b/dom/media/test/crashtests/576612-1.html
new file mode 100644
index 0000000000..04f993e780
--- /dev/null
+++ b/dom/media/test/crashtests/576612-1.html
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+
+ var v = document.getElementById("v");
+ v.src = "data:text/plain,_";
+ document.documentElement.appendChild(v);
+
+}
+</script>
+</head>
+<body onload="boom();"><video id="v" src="data:video/ogg;codecs=&quot;theora,vorbis&quot;,1"></video></body>
+</html>
diff --git a/dom/media/test/crashtests/691096-1.html b/dom/media/test/crashtests/691096-1.html
new file mode 100644
index 0000000000..3c3ebfc12a
--- /dev/null
+++ b/dom/media/test/crashtests/691096-1.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+var ITERATIONS = 200;
+
+function stoptest (evt)
+{
+ if (evt) {
+ // Note we reset 'src' to release decoder resources and cubeb streams to
+ // prevent OOM or OpenCubeb() failures.
+ evt.target.src = "";
+ }
+ document.documentElement.removeAttribute("class");
+}
+
+function boom()
+{
+ for (var i = 0; i < ITERATIONS; ++i) {
+ a = document.createElementNS("http://www.w3.org/1999/xhtml", "audio");
+ a.addEventListener("loadedmetadata", stoptest);
+ a.setAttributeNS(null, "autoplay", "");
+ a.setAttributeNS(null, "src", "sound.ogg");
+ }
+ setTimeout(stoptest, 250);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/media/test/crashtests/752784-1.html b/dom/media/test/crashtests/752784-1.html
new file mode 100644
index 0000000000..4644eeb89a
--- /dev/null
+++ b/dom/media/test/crashtests/752784-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function boom()
+{
+ document.getElementById("a").mozCaptureStream();
+}
+</script>
+</head>
+
+<body onload="boom();">
+<audio id="a" src="sound.ogg">
+</body>
+</html>
diff --git a/dom/media/test/crashtests/789075-1.html b/dom/media/test/crashtests/789075-1.html
new file mode 100644
index 0000000000..6cd673fb75
--- /dev/null
+++ b/dom/media/test/crashtests/789075-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+</head>
+<body>
+<video src="789075.webm" preload="metadata" id="v">
+</video>
+<!-- Note we reset 'src' to release decoder resources and cubeb streams to prevent OOM or OpenCubeb() failures. -->
+<script type="application/javascript">
+ var video = document.getElementById("v");
+ video.onloadeddata = function () {
+ video.play();
+ };
+ video.onended = function () {
+ video.src="";
+ document.documentElement.className = undefined;
+ };
+</script>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/789075.webm b/dom/media/test/crashtests/789075.webm
new file mode 100644
index 0000000000..602e53fca2
--- /dev/null
+++ b/dom/media/test/crashtests/789075.webm
Binary files differ
diff --git a/dom/media/test/crashtests/795892-1.html b/dom/media/test/crashtests/795892-1.html
new file mode 100644
index 0000000000..d73cea7f2e
--- /dev/null
+++ b/dom/media/test/crashtests/795892-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+function boom()
+{
+ var a = document.getElementById("a");
+ a.play();
+ a.onplaying = function () {
+ a.onplaying = null;
+ // Note we reset 'src' to release decoder resources and cubeb streams to
+ // prevent OOM or OpenCubeb() failures.
+ a.src = "";
+ document.documentElement.className = "";
+ }
+}
+</script>
+</head>
+
+<body>
+<video id="a" src="cors.webm" crossorigin preload="metadata" onloadedmetadata="boom();">
+</body>
+</html>
diff --git a/dom/media/test/crashtests/844563.html b/dom/media/test/crashtests/844563.html
new file mode 100644
index 0000000000..a3cb91838d
--- /dev/null
+++ b/dom/media/test/crashtests/844563.html
@@ -0,0 +1,5 @@
+<script>
+var a = document.createElementNS("http://www.w3.org/1999/xhtml", "audio");
+a.preservesPitch = a;
+</script>
+
diff --git a/dom/media/test/crashtests/846612.html b/dom/media/test/crashtests/846612.html
new file mode 100644
index 0000000000..070c375381
--- /dev/null
+++ b/dom/media/test/crashtests/846612.html
@@ -0,0 +1,8 @@
+<script>
+document.addEventListener("DOMContentLoaded", function() {
+ var a = document.querySelector("audio");
+ a.playbackRate = 2;
+ a.play();
+});
+</script>
+<audio src="495794-1.ogg"></audio>
diff --git a/dom/media/test/crashtests/852838.html b/dom/media/test/crashtests/852838.html
new file mode 100644
index 0000000000..0bea29351b
--- /dev/null
+++ b/dom/media/test/crashtests/852838.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <script>
+ var o0 = new window.AudioContext();
+ var o1 = o0.createBuffer(536870912, 1, 8192);
+ </script>
+ </head>
+ <body>
+ </body>
+</html>
diff --git a/dom/media/test/crashtests/865004.html b/dom/media/test/crashtests/865004.html
new file mode 100644
index 0000000000..4da39071c4
--- /dev/null
+++ b/dom/media/test/crashtests/865004.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ var ac = new AudioContext();
+ for (var j = 0; j < 200; ++j) {
+ ac.createScriptProcessor(undefined);
+ }
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/media/test/crashtests/865537-1.html b/dom/media/test/crashtests/865537-1.html
new file mode 100644
index 0000000000..4065eb3608
--- /dev/null
+++ b/dom/media/test/crashtests/865537-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML>
+<html>
+<body onload="doTest()">
+<base href="../unknown">
+<div id="test3"></div>
+<video id="test4"><source src="white.webm"></video>
+<script>
+function doTest() {
+ test3.appendChild(test4);
+}
+</script>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/865550.html b/dom/media/test/crashtests/865550.html
new file mode 100644
index 0000000000..b8626e8d67
--- /dev/null
+++ b/dom/media/test/crashtests/865550.html
@@ -0,0 +1,22 @@
+<html class="reftest-wait">
+ <head>
+ <script>
+ var i = 0;
+ var interval;
+ function crash() {
+ var o0 = new AudioContext();
+ o1 = o0.createBufferSource();
+ ++i;
+ if (i == 2000) {
+ document.documentElement.removeAttribute("class");
+ clearInterval(interval);
+ }
+ }
+ function start() {
+ interval = setInterval("crash()", 0)
+ }
+ </script>
+ </head>
+ <body onload="start()">
+ </body>
+</html>
diff --git a/dom/media/test/crashtests/868504.html b/dom/media/test/crashtests/868504.html
new file mode 100644
index 0000000000..94090c1c09
--- /dev/null
+++ b/dom/media/test/crashtests/868504.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ new AudioContext().createBufferSource().playbackRate.linearRampToValueAtTime(0, -1);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/media/test/crashtests/874869.html b/dom/media/test/crashtests/874869.html
new file mode 100644
index 0000000000..1fe3dbd2fc
--- /dev/null
+++ b/dom/media/test/crashtests/874869.html
@@ -0,0 +1,15 @@
+<script>
+var Context0= new AudioContext()
+var Panner0=Context0.createPanner();
+var BufferSource3=Context0.createBufferSource();
+Panner0.channelCount=0;
+BufferSource3.connect(Panner0);
+BufferSource3.buffer=function(){
+ var length=1;
+ var Buffer=Context0.createBuffer(1,length,'44200');
+ var bufferData= Buffer.getChannelData(0);
+ for (var i = 0; i < length; ++i) { bufferData[i] = 255;};
+ return Buffer;
+}();
+
+</script> \ No newline at end of file
diff --git a/dom/media/test/crashtests/874915.html b/dom/media/test/crashtests/874915.html
new file mode 100644
index 0000000000..59218b3da3
--- /dev/null
+++ b/dom/media/test/crashtests/874915.html
@@ -0,0 +1,24 @@
+<script>
+var Context0= new AudioContext()
+var BufferSource6=Context0.createBufferSource();
+
+setInterval(function(){
+BufferSource6.buffer=function(){
+ var length=11283;
+ var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+ var bufferData= Buffer.getChannelData(0);
+ for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(624))};
+ return Buffer;
+}();
+},0)
+
+BufferSource6.start(0.15831333969254047,0.23571860056836158,0.529235512483865);
+
+BufferSource6.buffer=function(){
+ var length=48517;
+ var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+ var bufferData= Buffer.getChannelData(0);
+ for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(365))};
+ return Buffer;
+}();
+</script> \ No newline at end of file
diff --git a/dom/media/test/crashtests/874934.html b/dom/media/test/crashtests/874934.html
new file mode 100644
index 0000000000..350ce28101
--- /dev/null
+++ b/dom/media/test/crashtests/874934.html
@@ -0,0 +1,23 @@
+<script>
+var Context0= new AudioContext()
+var BufferSource0=Context0.createBufferSource();
+BufferSource0.start(0.01932738965842873,0.33345631847623736,0.3893404237460345);
+BufferSource0.buffer=function(){
+ var length=35887;
+ var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+ var bufferData= Buffer.getChannelData(0);
+ for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(0.39765272522345185))};
+ return Buffer;
+}();
+
+BufferSource0.buffer=function(){
+ var length=15952;
+ var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+ var bufferData= Buffer.getChannelData(0);
+ for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(85))};
+ return Buffer;
+}();
+
+BufferSource0.playbackRate.value=20.401213286832185;
+
+</script>
diff --git a/dom/media/test/crashtests/874952.html b/dom/media/test/crashtests/874952.html
new file mode 100644
index 0000000000..a9a398fdb2
--- /dev/null
+++ b/dom/media/test/crashtests/874952.html
@@ -0,0 +1,11 @@
+<script>
+var Context0= new AudioContext()
+var ChannelSplitter0=Context0.createChannelSplitter();
+var BiquadFilter0=Context0.createBiquadFilter();
+var WaveShaper0=Context0.createWaveShaper();
+
+ChannelSplitter0.connect(BiquadFilter0,3,0);
+ChannelSplitter0.connect(WaveShaper0);
+BiquadFilter0.disconnect();
+WaveShaper0.connect(ChannelSplitter0);
+</script>
diff --git a/dom/media/test/crashtests/875144.html b/dom/media/test/crashtests/875144.html
new file mode 100644
index 0000000000..bf5d0d0861
--- /dev/null
+++ b/dom/media/test/crashtests/875144.html
@@ -0,0 +1,81 @@
+<script>
+Logger = {}
+Logger.error = function(e) {}
+Logger.comment = function(e) {}
+
+try { o0 = document.createElement('audio'); } catch(e) { Logger.error(Logger.comment(e)); }
+try { (document.body || document.documentElement).appendChild(o0); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o1 = new AudioContext(); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o2 = o1.createGain(); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o3 = o1.createBufferSource(); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o3.buffer = function() { o4 = o1.createBuffer(1, 3, 52970);
+o5 = o4.getChannelData(0);
+for(var i=0; i<3; ++i) {
+o5[i] = Math.sin(i * 63);
+}
+return o4;
+}(); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o3.buffer = function() { o6 = o1.createBuffer(1, 15, 41218);
+o7 = o6.getChannelData(0);
+for(var i=0; i<15; ++i) {
+o7[i] = Math.sin(i * 0);
+}
+return o6;
+}(); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o3.buffer = function() { o8 = o1.createBuffer(1, 0, 49074);
+o9 = o8.getChannelData(0);
+for(var i=0; i<0; ++i) {
+o9[i] = Math.sin(i * 0);
+}
+return o8;
+}(); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o3.buffer = function() { o10 = o1.createBuffer(1, 31, 86527);
+o11 = o10.getChannelData(0);
+for(var i=0; i<31; ++i) {
+o11[i] = Math.sin(i * 127);
+}
+return o10;
+}(); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o3.stop(-1) } catch(e) { Logger.error(Logger.comment(e)); }
+/* [Exception... "An attempt was made to use an object that is not, or is no longer, usable" code: "11" nsresult: "0x8053000b (InvalidStateError)" location: "file:///Users/cdiehl/dev/projects/peach/Peach/Utilities/JS/undefined.js Line: 602"] */
+try { o3.channelCountMode = 'explicit'; } catch(e) { Logger.error(Logger.comment(e)); }
+try { o12 = o1.createBiquadFilter(); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o3.buffer = function() { o13 = o1.createBuffer(1, 63, 28347);
+o14 = o13.getChannelData(0);
+for(var i=0; i<63; ++i) {
+o14[i] = Math.sin(i * 15);
+}
+return o13;
+}(); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o12.channelCount = 1; } catch(e) { Logger.error(Logger.comment(e)); }
+try { o12.connect(GainNode, 65536, 0) } catch(e) { Logger.error(Logger.comment(e)); }
+/* TypeError: Value does not implement interface AudioNode. */
+try { o3.buffer = function() { o15 = o1.createBuffer(1, 1, 72540);
+o16 = o15.getChannelData(0);
+for(var i=0; i<1; ++i) {
+o16[i] = Math.sin(i * 7);
+}
+return o15;
+}(); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o12.getFrequencyResponse(new Float32Array(7), new Float32Array(127), new Float32Array(7)) } catch(e) { Logger.error(Logger.comment(e)); }
+try { o12.getFrequencyResponse(new Float32Array(15), new Float32Array(127), new Float32Array(7)) } catch(e) { Logger.error(Logger.comment(e)); }
+try { o17 = document.createElement('audio'); } catch(e) { Logger.error(Logger.comment(e)); }
+try { (document.body || document.documentElement).appendChild(o0); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o3.buffer = function() { o18 = o1.createBuffer(1, 7, 91261);
+o19 = o18.getChannelData(0);
+for(var i=0; i<7; ++i) {
+o19[i] = Math.sin(i * 7);
+}
+return o18;
+}(); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o12.getFrequencyResponse(new Float32Array(31), new Float32Array(31), new Float32Array(127)) } catch(e) { Logger.error(Logger.comment(e)); }
+try { o20 = o1.createChannelSplitter(1, 2, 4, 16, 32); } catch(e) { Logger.error(Logger.comment(e)); }
+try { o12.channelCountMode = 'explicit'; } catch(e) { Logger.error(Logger.comment(e)); }
+try { o3.buffer = function() { o21 = o1.createBuffer(1, 0, 14451);
+o22 = o21.getChannelData(0);
+for(var i=0; i<0; ++i) {
+o22[i] = Math.sin(i * 63);
+}
+return o21;
+}(); } catch(e) { Logger.error(Logger.comment(e)); }
+</script>
diff --git a/dom/media/test/crashtests/875596.html b/dom/media/test/crashtests/875596.html
new file mode 100644
index 0000000000..7bac09dab7
--- /dev/null
+++ b/dom/media/test/crashtests/875596.html
@@ -0,0 +1,12 @@
+<script>
+try { o1 = new AudioContext(); } catch(e) { }
+try { o6 = o1.createGain(); } catch(e) { }
+try { o8 = o1.createBufferSource(); } catch(e) { }
+try { o6.gain.setValueCurveAtTime(new Float32Array(7), 0, 0) } catch(e) { }
+try { o8.connect(o6, 0, 0) } catch(e) { }
+try { o8.buffer = function() {
+ o19 = o1.createBuffer(1, 1, 76309);
+ for(var i=0; i<1; ++i) { }
+ return o19;
+}(); } catch(e) { }
+</script>
diff --git a/dom/media/test/crashtests/875911.html b/dom/media/test/crashtests/875911.html
new file mode 100644
index 0000000000..fbc52642b4
--- /dev/null
+++ b/dom/media/test/crashtests/875911.html
@@ -0,0 +1,3 @@
+<script>
+ new OfflineAudioContext(1, 10, 48000);
+</script>
diff --git a/dom/media/test/crashtests/876024-1.html b/dom/media/test/crashtests/876024-1.html
new file mode 100644
index 0000000000..5502d8e42d
--- /dev/null
+++ b/dom/media/test/crashtests/876024-1.html
@@ -0,0 +1,5 @@
+<script>
+o1 = new window.AudioContext(2, 8, 44100);
+o4 = o1.createBiquadFilter();
+o4.detune.setValueAtTime(0.0843, 1.7976931348623157e+308);
+</script>
diff --git a/dom/media/test/crashtests/876024-2.html b/dom/media/test/crashtests/876024-2.html
new file mode 100644
index 0000000000..4b9beb7453
--- /dev/null
+++ b/dom/media/test/crashtests/876024-2.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ var bufferSource = new AudioContext().createScriptProcessor().context.createBufferSource();
+ bufferSource.start(0, 0, 0);
+ bufferSource.stop(562949953421313);
+}
+
+</script></head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/media/test/crashtests/876118.html b/dom/media/test/crashtests/876118.html
new file mode 100644
index 0000000000..bc0630350a
--- /dev/null
+++ b/dom/media/test/crashtests/876118.html
@@ -0,0 +1,16 @@
+<script>
+var Context0= new AudioContext()
+var BufferSource7=Context0.createBufferSource();
+
+BufferSource7.connect(Context0.destination);
+BufferSource7.buffer=function(){
+ var length=7;
+ var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+ var bufferData= Buffer.getChannelData(0);for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(-1))};
+ return Buffer;
+}();
+
+
+Context0.destination.channelCountMode="explicit";
+Context0.destination.channelCount=519910189000000;
+</script>
diff --git a/dom/media/test/crashtests/876207.html b/dom/media/test/crashtests/876207.html
new file mode 100644
index 0000000000..7bfcb096b2
--- /dev/null
+++ b/dom/media/test/crashtests/876207.html
@@ -0,0 +1,30 @@
+<script>
+try { o1 = new window.OfflineAudioContext(1, 10, 44100); } catch(e) { }
+try { o2 = o1.createChannelSplitter(1); } catch(e) { }
+try { o3 = o1.createAnalyser(); } catch(e) { }
+try { o4 = o1.createWaveShaper(); } catch(e) { }
+try { o5 = o1.createChannelSplitter(6); } catch(e) { }
+try { o6 = o1.createAnalyser(); } catch(e) { }
+try { o7 = o1.createBufferSource(); } catch(e) { }
+try { o7.connect(o1.destination); } catch(e) { }
+try { o7.buffer = function() {
+o8 = o1.createBuffer(1, 3, o1.sampleRate);
+o9 = o8.getChannelData(0);
+for(var i = 0; i < 3; ++i) {
+o9[i] = Math.sin(i * 127);
+}
+return o8;
+}()
+; } catch(e) { }
+try { o7.playbackRate.cancelScheduledValues(0) } catch(e) { }
+try { o7.channelInterpretation = 'speakers'; } catch(e) { }
+try { o1.destination.channelInterpretation = 'speakers'; } catch(e) { }
+try { o5.connect(o1.destination, 1, 1) } catch(e) { }
+try { o1.listener.setOrientation(0, 1073741824, 1073741824, 4194304, 1, 0) } catch(e) { }
+try { o4.curve = new Float32Array(127); } catch(e) { }
+try { o6.getByteFrequencyData(new Uint8Array(12)) } catch(e) { }
+try { o6.disconnect() } catch(e) { }
+try { o1.destination.channelCount = 33554432; } catch(e) { }
+try { o7.playbackRate.setTargetAtTime(0, 8388608, 1) } catch(e) { }
+try { o6.getByteTimeDomainData(new Uint8Array(12)) } catch(e) { }
+</script>
diff --git a/dom/media/test/crashtests/876215.html b/dom/media/test/crashtests/876215.html
new file mode 100644
index 0000000000..07135e3628
--- /dev/null
+++ b/dom/media/test/crashtests/876215.html
@@ -0,0 +1,14 @@
+<script>
+try { o1 = new window.OfflineAudioContext(1, 10, 44100); } catch(e) { }
+try { o6 = o1.createScriptProcessor(0, 0, 2); } catch(e) { }
+try { o8 = o1.createBufferSource(); } catch(e) { }
+try { o8.connect(o1.destination); } catch(e) { }
+try { o8.connect(o6) } catch(e) { }
+try { o3.disconnect() } catch(e) { }
+try { o8.buffer = function() {
+o21 = o1.createBuffer(1, 3, o1.sampleRate);
+o22 = o21.getChannelData(0);
+return o21;
+}()
+; } catch(e) { }
+</script>
diff --git a/dom/media/test/crashtests/876249.html b/dom/media/test/crashtests/876249.html
new file mode 100644
index 0000000000..6f72b40bc1
--- /dev/null
+++ b/dom/media/test/crashtests/876249.html
@@ -0,0 +1,27 @@
+<script>
+var Context0= new AudioContext()
+var BufferSource0=Context0.createBufferSource();
+var BiquadFilter0=Context0.createBiquadFilter();
+BufferSource0.start(0,0.6167310480959713,0.7142638498917222);
+BiquadFilter0.connect(Context0.destination);
+BufferSource0.buffer=function(){
+ var length=86333;
+ var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+ var bufferData= Buffer.getChannelData(0);
+ for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(-1))};
+ return Buffer;
+}();
+
+BufferSource0.connect(BiquadFilter0);
+
+BufferSource0.buffer=function(){
+ var length=21989;
+ var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+ var bufferData= Buffer.getChannelData(0);
+ for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(0))};
+ return Buffer;
+}();
+
+BufferSource0.stop(0.04184641852043569);
+
+</script>
diff --git a/dom/media/test/crashtests/876252.html b/dom/media/test/crashtests/876252.html
new file mode 100644
index 0000000000..cb9cb63ed3
--- /dev/null
+++ b/dom/media/test/crashtests/876252.html
@@ -0,0 +1,23 @@
+<script>
+var Context0= new AudioContext()
+var BufferSource4=Context0.createBufferSource();
+BufferSource4.start(0.05386466556228697,0.397192713804543,0.48810303467325866);
+
+BufferSource4.buffer=function(){
+ var length=109076;
+ var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+ var bufferData= Buffer.getChannelData(0);
+ for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(370))};
+ return Buffer;
+}();
+
+BufferSource4.buffer=function(){
+ var length=19339;
+ var Buffer=Context0.createBuffer(1,length,53362);
+ var bufferData= Buffer.getChannelData(0);
+ for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(-0.16235407581552863))};
+ return Buffer;
+}();
+
+BufferSource4.stop(0.46482366253621876);
+</script>
diff --git a/dom/media/test/crashtests/876834.html b/dom/media/test/crashtests/876834.html
new file mode 100644
index 0000000000..f4ca6ee558
--- /dev/null
+++ b/dom/media/test/crashtests/876834.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+new OfflineAudioContext(0, 0, 3229622);
+</script>
diff --git a/dom/media/test/crashtests/877527.html b/dom/media/test/crashtests/877527.html
new file mode 100644
index 0000000000..c639d501b7
--- /dev/null
+++ b/dom/media/test/crashtests/877527.html
@@ -0,0 +1,37 @@
+<script>
+try { o1 = new window.AudioContext(2, 5, 44100); } catch(e) { }
+try { o2 = o1.createChannelMerger(1); } catch(e) { }
+try { o3 = o1.createDelay(10); } catch(e) { }
+try { o4 = o1.createBuffer(2, 2048, 8000); } catch(e) { }
+try { o5 = o1.createPanner(); } catch(e) { }
+try { o6 = o1.createBufferSource(); } catch(e) { }
+try { o7 = (function() {
+var buf = o1.createBuffer(1, 50000, o1.sampleRate);
+for(var j=0; j<1; ++j) {
+for(var i=0; i<50000; ++i) { buf.getChannelData(j)[i] = Math.sin(i * (9.8));}
+}
+return buf;
+})(); } catch(e) { }
+try { o6.buffer = o7; } catch(e) { }
+try { o6.connect(o5); } catch(e) { }
+try { o5.connect(o1.destination); } catch(e) { }
+try { o1.listener.speedOfSound = 0.0000019073486328125; } catch(e) { }
+try { o6.loop = true; } catch(e) { }
+try { o8 = (function() {
+var buf = o1.createBuffer(2, 1000, o1.sampleRate);
+for(var j=0; j<2; ++j) {
+for(var i=0; i<1000; ++i) { buf.getChannelData(j)[i] = Math.sin(i * (1));}
+}
+return buf;
+})(); } catch(e) { }
+try { o6.buffer = o7; } catch(e) { }
+try { o6.connect(o5); } catch(e) { }
+try { o5.connect(o1.destination); } catch(e) { }
+try { o6.loopEnd = 1.4901161193847656e-8; } catch(e) { }
+try { o6.connect(o1.destination); } catch(e) { }
+try { o6.buffer = o8; } catch(e) { }
+try { o5.setPosition(0.36, o1.destination.context.destination.channelCountMode, o1.destination.context.destination.channelInterpretation) } catch(e) { }
+try { o2.channelCountMode = 'explicit'; } catch(e) { }
+try { o1.listener.speedOfSound = 4; } catch(e) { }
+try { o1.startRendering(); } catch(e) { }
+</script>
diff --git a/dom/media/test/crashtests/877820.html b/dom/media/test/crashtests/877820.html
new file mode 100644
index 0000000000..6d65c1e9d9
--- /dev/null
+++ b/dom/media/test/crashtests/877820.html
@@ -0,0 +1,4 @@
+<script>
+o1 = new window.OfflineAudioContext(2, 5, 0.39);
+window.location.reload();
+</script> \ No newline at end of file
diff --git a/dom/media/test/crashtests/878014.html b/dom/media/test/crashtests/878014.html
new file mode 100644
index 0000000000..4a0ca6dce2
--- /dev/null
+++ b/dom/media/test/crashtests/878014.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+try { o2 = new window.AudioContext(1, 15, 44100); } catch(e) { }
+try { o5 = o2.createDelay(0.1); } catch(e) { }
+try { o6 = o2.createPanner(); } catch(e) { }
+try { o8 = o2.createBufferSource(); } catch(e) { }
+try { o9 = (function() {
+var buf = o2.createBuffer(1, 12134, o2.sampleRate);
+for(var j=0; j<1; ++j) {
+for(var i=0; i<12134; ++i) { buf.getChannelData(j)[i] = Math.sin(i * (-127));}
+}
+return buf;
+})(); } catch(e) { }
+try { o8.buffer = o9; } catch(e) { }
+try { o8.connect(o6); } catch(e) { }
+try { o6.connect(o5, 0, 0) } catch(e) { }
+try { o8.buffer = (function() {
+var buf = o2.createBuffer(1, 5409, o2.sampleRate);
+for(var j=0; j<1; ++j) {
+for(var i=0; i<5409; ++i) { buf.getChannelData(j)[i] = Math.sin(i * (-1));}
+}
+return buf;
+})(); } catch(e) { }
+setTimeout(function() { try { o5.delayTime.setValueAtTime(0.78, 121560862.56366833); } catch(e) { } setTimeout(done, 0); },128)
+try { o5.delayTime.value = 0.4283; } catch(e) { }
+
+function done() {
+ document.documentElement.removeAttribute("class");
+}
+</script>
diff --git a/dom/media/test/crashtests/878328.html b/dom/media/test/crashtests/878328.html
new file mode 100644
index 0000000000..ec7b39871b
--- /dev/null
+++ b/dom/media/test/crashtests/878328.html
@@ -0,0 +1,5 @@
+<script>
+o1 = new window.AudioContext(2, 7, 44100);
+o5 = o1.createDelay(1);
+o5.delayTime.setValueCurveAtTime(new Float32Array(3), 1.7976931348623157e+308, 0.64);
+</script> \ No newline at end of file
diff --git a/dom/media/test/crashtests/878407.html b/dom/media/test/crashtests/878407.html
new file mode 100644
index 0000000000..ae2918dc85
--- /dev/null
+++ b/dom/media/test/crashtests/878407.html
@@ -0,0 +1,11 @@
+<script>
+o1 = new window.AudioContext();
+o4 = o1.createDelay(0.4468);
+o6 = o1.createPanner();
+o7 = (function() {var buf = o1.createBuffer(1, 1000, o1.sampleRate);for(var j=0; j<1; ++j) {for(var i=0; i<1000; ++i) {buf.getChannelData(j)[i] = Math.sin(i * (-15));}}return buf;})();
+o8 = o1.createBufferSource();
+o8.buffer = o7;
+o8.connect(o6);
+o6.connect(o4)
+o4.delayTime.setValueAtTime(0.6019893103749466289898, 0.26)
+</script>
diff --git a/dom/media/test/crashtests/878478.html b/dom/media/test/crashtests/878478.html
new file mode 100644
index 0000000000..89a47ddb55
--- /dev/null
+++ b/dom/media/test/crashtests/878478.html
@@ -0,0 +1,30 @@
+<script>
+var Context0= new AudioContext()
+var BufferSource0=Context0.createBufferSource();
+
+BufferSource0.loop=true;
+
+BufferSource0.buffer=function(){
+ var channels=3;
+ var length=97252;
+ var Buffer=Context0.createBuffer(channels,length,Context0.sampleRate);
+ for(var y=0;y<channels;y++){
+ var bufferData= Buffer.getChannelData(y);
+ for (var i = 0; i < length; ++i) { bufferData[i] = 1;}
+ };
+ return Buffer;
+}();
+
+BufferSource0.playbackRate.cancelScheduledValues(0.4);
+
+BufferSource0.loopEnd=5e-324;
+
+BufferSource0.buffer=function(){
+ var length=26590;
+ var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+ var bufferData= Buffer.getChannelData(0);
+ for (var i = 0; i < length; ++i) { bufferData[i] = 1};
+ return Buffer;
+}();
+
+</script>
diff --git a/dom/media/test/crashtests/880129.html b/dom/media/test/crashtests/880129.html
new file mode 100644
index 0000000000..775e9d80ba
--- /dev/null
+++ b/dom/media/test/crashtests/880129.html
@@ -0,0 +1,9 @@
+<script>
+try { o1 = new window.AudioContext(3, 2, 44100); } catch(e) { }
+try { o6 = o1.createBufferSource(); } catch(e) { }
+try { o15 = o1.createAnalyser(); } catch(e) { }
+try { o15.fftSize = 32; } catch(e) { }
+try { o6.connect(o15,0,0) } catch(e) { }
+try { o27 = o1.createPanner(); } catch(e) { }
+try { o6.buffer = function(){var buffer = o1.createBuffer(2, 1148, o1.sampleRate);for(var c=0; c<2; c++) {for(var i=0; i<1148; i++) {buffer.getChannelData(c)[i] = 0;}}return buffer;}() } catch(e) { }
+</script> \ No newline at end of file
diff --git a/dom/media/test/crashtests/880202.html b/dom/media/test/crashtests/880202.html
new file mode 100644
index 0000000000..dc0fade9db
--- /dev/null
+++ b/dom/media/test/crashtests/880202.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var Context0= new window.OfflineAudioContext(15,12119,44100)
+var BufferSource1=Context0.createBufferSource();
+var Gain0=Context0.createGain();
+var Panner0=Context0.createPanner();
+Context0.listener.setPosition(29,135,158);
+
+BufferSource1.connect(Gain0);
+
+BufferSource1.buffer=function(){
+ var channels=3;
+ var length=53325;
+ var Buffer=Context0.createBuffer(channels,length,Context0.sampleRate);
+ for(var y=0;y<channels;y++){
+ var bufferData= Buffer.getChannelData(y);
+ for (var i = 0; i < length; ++i) {
+ bufferData[i] = i*(270);
+ }
+ };
+ return Buffer;
+}();
+
+Gain0.connect(Panner0);
+Panner0.panningModel="equalpower";
+
+
+setTimeout(function(){
+document.documentElement.removeAttribute("class");
+},500)
+
+</script>
diff --git a/dom/media/test/crashtests/880342-1.html b/dom/media/test/crashtests/880342-1.html
new file mode 100644
index 0000000000..7d1aa0c3e3
--- /dev/null
+++ b/dom/media/test/crashtests/880342-1.html
@@ -0,0 +1,208 @@
+<script>
+try { o1 = new window.AudioContext(2, 10, 1019159); } catch(e) { }
+try { o2 = o1.createBufferSource(); } catch(e) { }
+try { o3 = o1.createConvolver(); } catch(e) { }
+try { o4 = o1.createChannelMerger(2); } catch(e) { }
+try { o5 = o1.createAnalyser(); } catch(e) { }
+try { o6 = o1.createPanner(); } catch(e) { }
+try { o7 = o1.createDynamicsCompressor(); } catch(e) { }
+try { o8 = o1.createWaveShaper(); } catch(e) { }
+try { o9 = o1.createChannelSplitter(6); } catch(e) { }
+try { o10 = o1.createScriptProcessor(8192, 2, 3); } catch(e) { }
+try { o1.listener.setPosition(-144115188075855870, 0, -5e-324) } catch(e) { }
+try { o3.buffer = function(){var buffer = o1.createBuffer(2, 741, o1.sampleRate);for(var c=0; c<2; c++) {for(var i=0; i<741; i++) {buffer.getChannelData(c)[i] = 1;}}return buffer;}(); } catch(e) { }
+try { o10.onaudioprocess = function(e) { /* onEvent */ }; } catch(e) { }
+try { o3.connect(o5,0,0) } catch(e) { }
+try { o9.channelCountMode = 'max'; } catch(e) { }
+try { o10.onaudioprocess = function(e) { /* onEvent */ }; } catch(e) { }
+try { o7.channelInterpretation = 'speakers'; } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(2, 1887, 63346);for(var c=0; c<2; c++) {for(var i=0; i<1887; i++) {buffer.getChannelData(c)[i] = 1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o2.playbackRate.exponentialRampToValueAtTime(3.819464020334534, 32) } catch(e) { }
+try { o5.connect(o9,2,0) } catch(e) { }
+try { o9.channelCountMode = 'explicit'; } catch(e) { }
+try { o1.listener.speedOfSound = 72057594037927940; } catch(e) { }
+try { o1.destination.channelCountMode = 'explicit'; } catch(e) { }
+try { o7.threshold.value = 0.0646435404346891590021684237399313133209944; } catch(e) { }
+try { o7.connect(o10,0,0) } catch(e) { }
+try { o1.destination.channelInterpretation = 'speakers'; } catch(e) { }
+try { o3.connect(o4,0,0) } catch(e) { }
+try { o7.release.value = 23.030355486273447; } catch(e) { }
+try { o9.connect(o9,4,0) } catch(e) { }
+try { o6.channelCountMode = 'max'; } catch(e) { }
+try { o7.threshold.value = 0.6395867363641939418172910336579661816358566284179687500; } catch(e) { }
+try { o2.connect(o9,3,0) } catch(e) { }
+try { o10.onaudioprocess = function(e) { /* onEvent */ }; } catch(e) { }
+try { o7.connect(o10,0,0) } catch(e) { }
+try { o5.connect(o5,0,0) } catch(e) { }
+try { o2.playbackRate.value = 5e-324; } catch(e) { }
+try { o4.channelInterpretation = 'discrete'; } catch(e) { }
+try { o2.playbackRate.value = 1.2211628339508704; } catch(e) { }
+try { o2.channelCountMode = 'clamped-max'; } catch(e) { }
+try { o1.listener.dopplerFactor = 32; } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(22, 1811, 21177);for(var c=0; c<22; c++) {for(var i=0; i<1811; i++) {buffer.getChannelData(c)[i] = 1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o5.channelCountMode = 'max'; } catch(e) { }
+try { o1.listener.speedOfSound = 1024; } catch(e) { }
+try { o2.playbackRate.value = 9.999999999999998e-91; } catch(e) { }
+try { o1.listener.speedOfSound = 16; } catch(e) { }
+try { o8.curve = new Float32Array(256); } catch(e) { }
+try { o1.listener.setVelocity(0, 128, 4) } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(23, 483, o1.sampleRate);for(var c=0; c<23; c++) {for(var i=0; i<483; i++) {buffer.getChannelData(c)[i] = 0.026;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(3, 945, 43803);for(var c=0; c<3; c++) {for(var i=0; i<945; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(19, 997, 23781);for(var c=0; c<19; c++) {for(var i=0; i<997; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o1.listener.speedOfSound = -8; } catch(e) { }
+try { o3.channelCountMode = 'explicit'; } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(3, 1740, o1.sampleRate);for(var c=0; c<3; c++) {for(var i=0; i<1740; i++) {buffer.getChannelData(c)[i] = 8;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(1, 1057, 30602);for(var c=0; c<1; c++) {for(var i=0; i<1057; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(3, 78, o1.sampleRate);for(var c=0; c<3; c++) {for(var i=0; i<78; i++) {buffer.getChannelData(c)[i] = 10;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o1.listener.setPosition(9.999999999999995e-275, 0.0001, 2) } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(1, 863, o1.sampleRate);for(var c=0; c<1; c++) {for(var i=0; i<863; i++) {buffer.getChannelData(c)[i] = 1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o8.channelCount = 3; } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(2, 1821, o1.sampleRate);for(var c=0; c<2; c++) {for(var i=0; i<1821; i++) {buffer.getChannelData(c)[i] = 0.3655;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o6.connect(o6,0,0) } catch(e) { }
+try { o1.listener.setOrientation(128, -0.479527496, 128, 1, 1, -16) } catch(e) { }
+try { o4.connect(o8,0,0) } catch(e) { }
+try { o7.reduction.exponentialRampToValueAtTime(1.7976931348623157e+308, 2048) } catch(e) { }
+try { o1.listener.dopplerFactor = 0.5754; } catch(e) { }
+try { o7.release.value = 0; } catch(e) { }
+try { o5.getFloatFrequencyData(new Float32Array(2048)) } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(2, 120, 42419);for(var c=0; c<2; c++) {for(var i=0; i<120; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o3.buffer = function(){var buffer = o1.createBuffer(1, 1620, o1.sampleRate);for(var c=0; c<1; c++) {for(var i=0; i<1620; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}(); } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(1, 823, 77239);for(var c=0; c<1; c++) {for(var i=0; i<823; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o1.destination.channelInterpretation = 'speakers'; } catch(e) { }
+try { o1.listener.setPosition(2048, 0.000522899209, -4503599627370495) } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(3, 84028, 75483);for(var c=0; c<3; c++) {for(var i=0; i<84028; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o2.playbackRate.setTargetAtTime(5e-324, 9.999999999999998e-104, 0) } catch(e) { }
+try { o7.attack.value = 9.999999999999994e-236; } catch(e) { }
+try { o1.listener.dopplerFactor = 1024; } catch(e) { }
+try { o3.connect(o7,0,0) } catch(e) { }
+try { o2.playbackRate.linearRampToValueAtTime(0, 0) } catch(e) { }
+try { o4.connect(o10,0,0) } catch(e) { }
+try { o1.listener.setVelocity(0.682, 32, 1e-76) } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(3, 201, o1.sampleRate);for(var c=0; c<3; c++) {for(var i=0; i<201; i++) {buffer.getChannelData(c)[i] = 4;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o2.connect(o6,0,0) } catch(e) { }
+try { o5.getByteFrequencyData(new Uint8Array(32)) } catch(e) { }
+try { o3.connect(o6,0,0) } catch(e) { }
+try { o7.channelCount = 1; } catch(e) { }
+try { o2.playbackRate.setValueCurveAtTime(new Float32Array(512), 8, 1) } catch(e) { }
+try { o3.connect(o4,0,1) } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(3, 1996, o1.sampleRate);for(var c=0; c<3; c++) {for(var i=0; i<1996; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o1.listener.dopplerFactor = 2; } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(2, 983, 60517);for(var c=0; c<2; c++) {for(var i=0; i<983; i++) {buffer.getChannelData(c)[i] = 1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o6.coneInnerAngle = 360; } catch(e) { }
+try { o8.curve = new Float32Array(512); } catch(e) { }
+try { o1.listener.setPosition(32, 16, 9.999999999999995e-280) } catch(e) { }
+try { o6.connect(o6,0,0) } catch(e) { }
+try { o1.listener.setPosition(2097151, 512, 5e-324) } catch(e) { }
+try { o7.channelCountMode = 'clamped-max'; } catch(e) { }
+try { o1.destination.channelCountMode = 'max'; } catch(e) { }
+try { o1.listener.setPosition(0, 1000000, 64) } catch(e) { }
+try { o4.connect(o5,0,0) } catch(e) { }
+try { o9.connect(o4,0,1) } catch(e) { }
+try { o7.attack.setValueCurveAtTime(new Float32Array(8), 256, 2048) } catch(e) { }
+try { o9.channelCountMode = 'explicit'; } catch(e) { }
+try { o1.listener.dopplerFactor = 5e-324; } catch(e) { }
+try { o4.connect(o10,0,0) } catch(e) { }
+try { o7.ratio.cancelScheduledValues(1) } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(1, 1590, 9733);for(var c=0; c<1; c++) {for(var i=0; i<1590; i++) {buffer.getChannelData(c)[i] = 2;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o1.destination.channelCount = 2; } catch(e) { }
+try { o1.destination.channelInterpretation = 'speakers'; } catch(e) { }
+try { o5.channelCountMode = 'max'; } catch(e) { }
+try { o9.channelCountMode = 'clamped-max'; } catch(e) { }
+try { o7.attack.setTargetAtTime(0.11499421161482907549622467513472656719386577606201171875000, 1, 1.7976931348623157e+308) } catch(e) { }
+try { o2.playbackRate.value = 1; } catch(e) { }
+try { o3.normalize = false; } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(2, 1866, o1.sampleRate);for(var c=0; c<2; c++) {for(var i=0; i<1866; i++) {buffer.getChannelData(c)[i] = 0.174908422905697580329587026426452212035655975341797;}}return buffer;}(); } catch(e) { }
+try { o2.playbackRate.value = 1.0; } catch(e) { }
+try { o7.threshold.value = 100; } catch(e) { }
+try { o1.listener.setVelocity(961.4441892370145, 9.999999999999999e-157, 1) } catch(e) { }
+try { o5.getByteFrequencyData(new Uint8Array(2)) } catch(e) { }
+try { o6.connect(o10,0,0) } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(3, 1176, o1.sampleRate);for(var c=0; c<3; c++) {for(var i=0; i<1176; i++) {buffer.getChannelData(c)[i] = 9.753993292300242;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o2.playbackRate.linearRampToValueAtTime(0.8687, 32) } catch(e) { }
+try { o5.channelCountMode = 'explicit'; } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(13, 703, 12723);for(var c=0; c<13; c++) {for(var i=0; i<703; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o2.loopEnd = 1.7976931348623157e+308; } catch(e) { }
+try { o3.connect(o7,0,0) } catch(e) { }
+try { o1.destination.channelCountMode = 'clamped-max'; } catch(e) { }
+try { o1.destination.channelInterpretation = 'discrete'; } catch(e) { }
+try { o2.connect(o10,0,0) } catch(e) { }
+try { o3.normalize = false; } catch(e) { }
+try { /* switch-case did not return anything. */ } catch(e) { }
+try { o10.connect(o8,0,0) } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(3, 132, 88507);for(var c=0; c<3; c++) {for(var i=0; i<132; i++) {buffer.getChannelData(c)[i] = 1.7976931348623157e+308;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o2.loopStart = 1.7976931348623157e+308; } catch(e) { }
+try { o1.listener.dopplerFactor = 1024; } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(1, 40, o1.sampleRate);for(var c=0; c<1; c++) {for(var i=0; i<40; i++) {buffer.getChannelData(c)[i] = 1.3785770335346594;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o4.connect(o9,5,0) } catch(e) { }
+try { o8.curve = new Float32Array(16); } catch(e) { }
+try { o10.onaudioprocess = function(e) { /* onEvent */ }; } catch(e) { }
+try { o6.channelCountMode = 'explicit'; } catch(e) { }
+try { o2.playbackRate.value = 0; } catch(e) { }
+try { o4.channelCount = 3; } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(3, 220, o1.sampleRate);for(var c=0; c<3; c++) {for(var i=0; i<220; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o1.destination.channelInterpretation = 'discrete'; } catch(e) { }
+try { o1.listener.setPosition(70368744177664, 2048, 1.7976931348623157e+308) } catch(e) { }
+try { o2.playbackRate.setValueCurveAtTime(new Float32Array(128), 1.7976931348623157e+308, 0.75) } catch(e) { }
+try { o5.fftSize = 118; } catch(e) { }
+try { o5.minDecibels = 1; } catch(e) { }
+try { o7.release.value = 5e-324; } catch(e) { }
+try { o2.channelCount = 3; } catch(e) { }
+try { o2.channelCountMode = 'clamped-max'; } catch(e) { }
+try { o3.normalize = false; } catch(e) { }
+try { o1.listener.speedOfSound = 2; } catch(e) { }
+try { o2.loopStart = 32; } catch(e) { }
+try { o3.channelCountMode = 'max'; } catch(e) { }
+try { o1.listener.setPosition(0.37976588317653304, -274877906943, 64) } catch(e) { }
+try { o8.curve = new Float32Array(4); } catch(e) { }
+try { o1.listener.setVelocity(16, -1024, 0) } catch(e) { }
+try { o5.minDecibels = 10000; } catch(e) { }
+try { o2.playbackRate.value = 5e-324; } catch(e) { }
+try { o3.connect(o9,1,0) } catch(e) { }
+try { o10.onaudioprocess = function(e) { /* onEvent */ }; } catch(e) { }
+try { o5.connect(o8,0,0) } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(3, 554, o1.sampleRate);for(var c=0; c<3; c++) {for(var i=0; i<554; i++) {buffer.getChannelData(c)[i] = 0.000001;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o7.release.value = 0; } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(1, 1289, 29583);for(var c=0; c<1; c++) {for(var i=0; i<1289; i++) {buffer.getChannelData(c)[i] = 5e-324;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o1.listener.setOrientation(1024, 64, 16, 1024, 1, 68719476735) } catch(e) { }
+try { o1.listener.setOrientation(512, 10000000, 274877906944, 9.999999999999998e-113, -8, 3.6191134923595274) } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(1, 1453, 15258);for(var c=0; c<1; c++) {for(var i=0; i<1453; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o8.channelInterpretation = 'discrete'; } catch(e) { }
+try { o5.channelInterpretation = 'discrete'; } catch(e) { }
+try { o7.connect(o9,4,0) } catch(e) { }
+try { o8.connect(o10,0,0) } catch(e) { }
+try { o1.listener.setPosition(18014398509481984, 16, 0.505129302503804056279079759406158700585365295410156250000) } catch(e) { }
+try { o10.connect(o9,5,0) } catch(e) { }
+try { o2.loop = false; } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(11, 1673, o1.sampleRate);for(var c=0; c<11; c++) {for(var i=0; i<1673; i++) {buffer.getChannelData(c)[i] = 0;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(2, 577, o1.sampleRate);for(var c=0; c<2; c++) {for(var i=0; i<577; i++) {buffer.getChannelData(c)[i] = 0.5611;}}return buffer;}() } catch(e) { }
+try { o2.connect(o1.destination); } catch(e) { }
+try { o1.listener.setOrientation(64, 2049, 5e-324, 0.1777, 2, 7) } catch(e) { }
+try { o5.maxDecibels = 128; } catch(e) { }
+try { o2.start(0) } catch(e) { }
+</script> \ No newline at end of file
diff --git a/dom/media/test/crashtests/880342-2.html b/dom/media/test/crashtests/880342-2.html
new file mode 100644
index 0000000000..a8ef88ae70
--- /dev/null
+++ b/dom/media/test/crashtests/880342-2.html
@@ -0,0 +1,8 @@
+<script>
+try { o1 = new window.AudioContext(2, 10, 1019159); } catch(e) { }
+try { o2 = o1.createBufferSource(); } catch(e) { }
+try { o3 = o1.createConvolver(); } catch(e) { }
+try { o3.buffer = function(){var buffer = o1.createBuffer(2, 741, o1.sampleRate);for(var c=0; c<2; c++) {for(var i=0; i<741; i++) {buffer.getChannelData(c)[i] = 1;}}return buffer;}(); } catch(e) { }
+try { o2.buffer = function(){var buffer = o1.createBuffer(2, 120, 42419);for(var c=0; c<2; c++) {for(var i=0; i<120; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}() } catch(e) { }
+try { o3.buffer = function(){var buffer = o1.createBuffer(1, 1620, o1.sampleRate);for(var c=0; c<1; c++) {for(var i=0; i<1620; i++) {buffer.getChannelData(c)[i] = -1;}}return buffer;}(); } catch(e) { }
+</script> \ No newline at end of file
diff --git a/dom/media/test/crashtests/880384.html b/dom/media/test/crashtests/880384.html
new file mode 100644
index 0000000000..798fbf133d
--- /dev/null
+++ b/dom/media/test/crashtests/880384.html
@@ -0,0 +1,8 @@
+<script>
+o1 = new window.AudioContext(3, 256, 44100);
+o2 = o1.createBufferSource();
+o3 = o1.createConvolver();
+o3.normalize = false;
+o3.buffer = function(){var buffer = o1.createBuffer(2, 1051, o1.sampleRate);for(var c=0; c<2; c++) {for(var i=0; i<1051; i++) {buffer.getChannelData(c)[i] = 1;}}return buffer;}();
+o3.buffer = function(){var buffer = o1.createBuffer(2, 1112, o1.sampleRate);for(var c=0; c<2; c++) {for(var i=0; i<1112; i++) {buffer.getChannelData(c)[i] = 1;}}return buffer;}();
+</script>
diff --git a/dom/media/test/crashtests/880404.html b/dom/media/test/crashtests/880404.html
new file mode 100644
index 0000000000..bf34932388
--- /dev/null
+++ b/dom/media/test/crashtests/880404.html
@@ -0,0 +1,6 @@
+<script>
+o1 = new window.OfflineAudioContext(2, 32, 44100);
+o12 = o1.createConvolver();
+o12.buffer = function(){var buffer = o1.createBuffer(1, 78, o1.sampleRate);for(var c=0; c<1; c++) {for(var i=0; i<78; i++) {buffer.getChannelData(c)[i] = 1;}}return buffer;}();
+o1.startRendering();
+</script> \ No newline at end of file
diff --git a/dom/media/test/crashtests/880724.html b/dom/media/test/crashtests/880724.html
new file mode 100644
index 0000000000..b57b5f9964
--- /dev/null
+++ b/dom/media/test/crashtests/880724.html
@@ -0,0 +1,13 @@
+<script>
+o1 = new window.AudioContext();
+o5 = o1.createConvolver();
+o5.buffer = function() {
+ var buffer = o1.createBuffer(2, 3, 33120);
+ for(var c=0; c<2; c++) {
+ for(var i=0; i<3; i++) {
+ buffer.getChannelData(c)[i] = -1;
+ }
+ }
+ return buffer;
+}();
+</script> \ No newline at end of file
diff --git a/dom/media/test/crashtests/881775.html b/dom/media/test/crashtests/881775.html
new file mode 100644
index 0000000000..d55c45d17e
--- /dev/null
+++ b/dom/media/test/crashtests/881775.html
@@ -0,0 +1,25 @@
+<script>
+o1 = new window.AudioContext(2, 16, 44100);
+o2 = o1.createBufferSource();
+o12 = o1.createBiquadFilter();
+o1.destination.channelCountMode = 'max';
+o2.buffer = function(){
+ var buffer = o1.createBuffer(2, 326, 77632);
+ for(var c=0; c<2; c++) {
+ for(var i=0; i<326; i++) {
+ buffer.getChannelData(c)[i] = -1;
+ }
+ }
+ return buffer;
+}();
+o2.connect(o1.destination);
+o2.buffer = function(){
+ var buffer = o1.createBuffer(3, 405, o1.sampleRate);
+ for(var c=0; c<3; c++) {
+ for(var i=0; i<405; i++) {
+ buffer.getChannelData(c)[i] = 1;
+ }
+ }
+ return buffer;
+}();
+</script>
diff --git a/dom/media/test/crashtests/882956.html b/dom/media/test/crashtests/882956.html
new file mode 100644
index 0000000000..ae7b441f99
--- /dev/null
+++ b/dom/media/test/crashtests/882956.html
@@ -0,0 +1,15 @@
+<script>
+o1 = new window.AudioContext(1, 2048, 44100);
+o2 = o1.createBufferSource();
+o1.destination.channelCountMode = 'max';
+o2.connect(o1.destination);
+o2.buffer = function(){
+ var buffer = o1.createBuffer(30, 442, 94933);
+ for(var c=0; c<30; c++) {
+ for(var i=0; i<442; i++) {
+ buffer.getChannelData(c)[i] = 1;
+ }
+ }
+ return buffer;
+}();
+</script>
diff --git a/dom/media/test/crashtests/884459.html b/dom/media/test/crashtests/884459.html
new file mode 100644
index 0000000000..e321d569f2
--- /dev/null
+++ b/dom/media/test/crashtests/884459.html
@@ -0,0 +1,12 @@
+<script>
+var Context0= new window.OfflineAudioContext(14,191531,44100)
+var BufferSource1=Context0.createBufferSource();
+
+setInterval(function(){
+BufferSource1.playbackRate.setTargetAtTime(0xC8F461D3EE6B2,(Context0.currentTime+0.0677539280615747),0.826130285160616);
+BufferSource1.playbackRate.setValueAtTime(35467.63924283907536607336193,0);
+},1)
+
+Context0.startRendering();
+
+</script>
diff --git a/dom/media/test/crashtests/889042.html b/dom/media/test/crashtests/889042.html
new file mode 100644
index 0000000000..9f74979c58
--- /dev/null
+++ b/dom/media/test/crashtests/889042.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+ (new AudioContext()).createConvolver().buffer = null;
+</script>
diff --git a/dom/media/test/crashtests/907986-1.html b/dom/media/test/crashtests/907986-1.html
new file mode 100644
index 0000000000..4dec6bc480
--- /dev/null
+++ b/dom/media/test/crashtests/907986-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var context = new window.OfflineAudioContext(1, 100, 48000);
+context.oncomplete = function(e) {
+ document.documentElement.removeAttribute("class");
+};
+// zero front vector
+context.listener.setOrientation(0, 0, 0, 6.311749985202524e+307, 0, 0);
+var panner = context.createPanner();
+panner.setPosition(3.40282e+38, 4, 3.40282e+38);
+panner.connect(context.destination);
+var source = context.createOscillator();
+source.connect(panner);
+source.start(0);
+context.startRendering();
+</script>
diff --git a/dom/media/test/crashtests/907986-2.html b/dom/media/test/crashtests/907986-2.html
new file mode 100644
index 0000000000..e0626ba2c2
--- /dev/null
+++ b/dom/media/test/crashtests/907986-2.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var context = new window.OfflineAudioContext(1, 100, 48000);
+context.oncomplete = function(e) {
+ document.documentElement.removeAttribute("class");
+};
+// zero up vector
+context.listener.setOrientation(0, 6.311749985202524e+307, 0, 0, 0, 0);
+var panner = context.createPanner();
+panner.setPosition(1, 2, 3);
+panner.connect(context.destination);
+var source = context.createOscillator();
+source.connect(panner);
+source.start(0);
+context.startRendering();
+</script>
diff --git a/dom/media/test/crashtests/907986-3.html b/dom/media/test/crashtests/907986-3.html
new file mode 100644
index 0000000000..75b756c363
--- /dev/null
+++ b/dom/media/test/crashtests/907986-3.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var context = new window.OfflineAudioContext(1, 100, 48000);
+context.oncomplete = function(e) {
+ document.documentElement.removeAttribute("class");
+};
+// linearly dependent
+context.listener.setOrientation(0, 0, -6.311749985202524e+307, 0, 0, 6.311749985202524e+307);
+var panner = context.createPanner();
+panner.setPosition(1, 2, 3);
+panner.connect(context.destination);
+var source = context.createOscillator();
+source.connect(panner);
+source.start(0);
+context.startRendering();
+</script>
diff --git a/dom/media/test/crashtests/907986-4.html b/dom/media/test/crashtests/907986-4.html
new file mode 100644
index 0000000000..a73500efca
--- /dev/null
+++ b/dom/media/test/crashtests/907986-4.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var context = new window.OfflineAudioContext(1, 100, 48000);
+context.oncomplete = function(e) {
+ document.documentElement.removeAttribute("class");
+};
+var panner = context.createPanner();
+panner.setPosition(0, 3, 0); // directly overhead
+panner.connect(context.destination);
+var source = context.createOscillator();
+source.connect(panner);
+source.start(0);
+context.startRendering();
+</script>
diff --git a/dom/media/test/crashtests/910171-1.html b/dom/media/test/crashtests/910171-1.html
new file mode 100644
index 0000000000..9f3ec831be
--- /dev/null
+++ b/dom/media/test/crashtests/910171-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var context = new window.OfflineAudioContext(1, 4096, 48000);
+context.oncomplete = function(e) {
+ document.documentElement.removeAttribute("class");
+};
+var delay = context.createDelay();
+delay.connect(context.destination);
+delay.delayTime.value = 1.0;
+var buffer = context.createBuffer(1, 2048, context.sampleRate);
+var source = context.createBufferSource();
+source.buffer = buffer;
+source.connect(delay);
+source.start();
+context.startRendering();
+</script>
diff --git a/dom/media/test/crashtests/920987.html b/dom/media/test/crashtests/920987.html
new file mode 100644
index 0000000000..6e8b2992a6
--- /dev/null
+++ b/dom/media/test/crashtests/920987.html
@@ -0,0 +1,6 @@
+<script>
+var ctx = new AudioContext();
+var buffer = ctx.createBuffer(1, 1000, ctx.sampleRate);
+var array = new Float32Array(900);
+buffer.copyToChannel(array, 0, 0xfffffff8);
+</script>
diff --git a/dom/media/test/crashtests/925619-1.html b/dom/media/test/crashtests/925619-1.html
new file mode 100644
index 0000000000..146c531f9b
--- /dev/null
+++ b/dom/media/test/crashtests/925619-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+// 1024 > 89478.5 * 48000 - (1 << 32)
+var context = new window.OfflineAudioContext(1, 1024, 48000);
+context.oncomplete = function(e) {
+ document.documentElement.removeAttribute("class");
+};
+var buffer = context.createBuffer(1, 2048, context.sampleRate);
+var source = context.createBufferSource();
+source.buffer = buffer;
+source.start(89478.5); // 89478.5 is a little greater than 2^32 / 48000.
+context.startRendering();
+</script>
diff --git a/dom/media/test/crashtests/925619-2.html b/dom/media/test/crashtests/925619-2.html
new file mode 100644
index 0000000000..e734b8bcad
--- /dev/null
+++ b/dom/media/test/crashtests/925619-2.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var context = new window.OfflineAudioContext(1, 2048, 48000);
+// 1024 > 89478.5 * 48000 - (1 << 32)
+var buffer = context.createBuffer(1, 1024, context.sampleRate);
+var source = context.createBufferSource();
+source.buffer = buffer;
+source.onended = function(e) {
+ document.documentElement.removeAttribute("class");
+};
+source.start(0);
+source.stop(89478.5); // 89478.5 is a little greater than 2^32 / 48000.
+context.startRendering();
+</script>
diff --git a/dom/media/test/crashtests/926619.html b/dom/media/test/crashtests/926619.html
new file mode 100644
index 0000000000..2ead02af4e
--- /dev/null
+++ b/dom/media/test/crashtests/926619.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ var ac = new window.AudioContext();
+
+ var _ChannelMergerNode = ac.createChannelMerger(4);
+
+ var _MediaStreamAudioDestinationNode = ac.createMediaStreamDestination();
+ var _MediaStream = _MediaStreamAudioDestinationNode.stream;
+ var _MediaStreamAudioSourceNode = ac.createMediaStreamSource(_MediaStream);
+
+ _ChannelMergerNode.connect(_MediaStreamAudioDestinationNode, 0, 0);
+ _MediaStreamAudioSourceNode.connect(_ChannelMergerNode, 0, 0);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/media/test/crashtests/933151.html b/dom/media/test/crashtests/933151.html
new file mode 100644
index 0000000000..3d45f7af38
--- /dev/null
+++ b/dom/media/test/crashtests/933151.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var ac = new window.AudioContext();
+ var buffer = ac.createBuffer(1, 24313, 47250);
+ buffer.copyFromChannel(buffer.getChannelData(0), '');
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/media/test/crashtests/933156.html b/dom/media/test/crashtests/933156.html
new file mode 100644
index 0000000000..b89445a43d
--- /dev/null
+++ b/dom/media/test/crashtests/933156.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+function boom()
+{
+ var ac = new window.AudioContext();
+
+ var panner = ac.createPanner();
+ panner.setPosition(8, 0.7643051305237005, 0.10292575673733972);
+
+ var oscillator = ac.createOscillator();
+ oscillator.connect(panner);
+ oscillator.start(0);
+
+ setTimeout(function() {
+ panner.panningModel = 'equalpower';
+ oscillator.stop(0);
+ document.documentElement.removeAttribute("class");
+ }, 0.5);
+}
+boom();
+</script>
+</html>
diff --git a/dom/media/test/crashtests/944851.html b/dom/media/test/crashtests/944851.html
new file mode 100644
index 0000000000..4f663accc4
--- /dev/null
+++ b/dom/media/test/crashtests/944851.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+var ac = new AudioContext(1, 1354, 44100);
+var shaper = ac.createWaveShaper();
+var biquad = ac.createBiquadFilter();
+shaper.connect(biquad.frequency);
+biquad.getFrequencyResponse(new Float32Array(55785),
+ new Float32Array(62876),
+ new Float32Array(45111));
+
+</script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/952756.html b/dom/media/test/crashtests/952756.html
new file mode 100644
index 0000000000..ffced2e400
--- /dev/null
+++ b/dom/media/test/crashtests/952756.html
@@ -0,0 +1,19 @@
+<script>
+var Context0= new AudioContext()
+var BufferSource0=Context0.createBufferSource();
+BufferSource0.buffer=function(){
+ var length=35887;
+ var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+ var bufferData= Buffer.getChannelData(0);
+ for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(0.39765272522345185))};
+ return Buffer;
+}();
+BufferSource0.start(0.01932738965842873,0.33345631847623736,0.3893404237460345);
+BufferSource0.buffer=function(){
+ var length=15952;
+ var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+ var bufferData= Buffer.getChannelData(0);
+ for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(85))};
+ return Buffer;
+}();
+</script>
diff --git a/dom/media/test/crashtests/986901.html b/dom/media/test/crashtests/986901.html
new file mode 100644
index 0000000000..343df2c0ed
--- /dev/null
+++ b/dom/media/test/crashtests/986901.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+ var ac = new window.AudioContext();
+ var delay1 = ac.createDelay(0.02);
+ var delay2 = ac.createDelay(0.002);
+ var source = ac.createOscillator();
+ source.start(0);
+ source.connect(delay1, 0, 0);
+ delay2.connect(delay1, 0, 0);
+ delay1.connect(delay2, 0, 0);
+</script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/990794.html b/dom/media/test/crashtests/990794.html
new file mode 100644
index 0000000000..8b40088b1a
--- /dev/null
+++ b/dom/media/test/crashtests/990794.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<script>
+var ctx = new AudioContext();
+var source = ctx.createOscillator();
+source.start(0);
+
+function appendMerger(src) {
+ const inputCount = 18;
+
+ var merger = ctx.createChannelMerger(32);
+
+ for (var i = 0; i < inputCount; ++i) {
+ src.connect(merger, 0, i);
+ }
+
+ return merger;
+}
+
+for (var i = 0; i < 6; ++i) {
+ source = appendMerger(source);
+}
+</script>
diff --git a/dom/media/test/crashtests/995289.html b/dom/media/test/crashtests/995289.html
new file mode 100644
index 0000000000..c988f41fa8
--- /dev/null
+++ b/dom/media/test/crashtests/995289.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<script>
+var r0=new AudioContext();
+var r5=r0.createOscillator();
+var r6=r0.createPeriodicWave(new Float32Array(1),new Float32Array(1));
+r5.frequency.value = 4294967295;
+r5.start(0);
+r5.setPeriodicWave(r6);
+</script>
diff --git a/dom/media/test/crashtests/adts-truncated.aac b/dom/media/test/crashtests/adts-truncated.aac
new file mode 100644
index 0000000000..670f696e1d
--- /dev/null
+++ b/dom/media/test/crashtests/adts-truncated.aac
Binary files differ
diff --git a/dom/media/test/crashtests/adts.aac b/dom/media/test/crashtests/adts.aac
new file mode 100644
index 0000000000..208515464a
--- /dev/null
+++ b/dom/media/test/crashtests/adts.aac
Binary files differ
diff --git a/dom/media/test/crashtests/analyser-channels-1.html b/dom/media/test/crashtests/analyser-channels-1.html
new file mode 100644
index 0000000000..2f3133cf13
--- /dev/null
+++ b/dom/media/test/crashtests/analyser-channels-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+ var context = new window.OfflineAudioContext(1, 256, 48000);
+ var analyser = context.createAnalyser();
+ analyser.channelCount = 2;
+ analyser.channelCountMode = "explicit";
+ analyser.fftSize = 32;
+ var source = context.createOscillator();
+ source.connect(analyser);
+ source.start(0);
+ context.startRendering().
+ then(function() {
+ document.documentElement.removeAttribute("class");
+ });
+</script>
diff --git a/dom/media/test/crashtests/audiocontext-after-unload-1.html b/dom/media/test/crashtests/audiocontext-after-unload-1.html
new file mode 100644
index 0000000000..9b4f1181d2
--- /dev/null
+++ b/dom/media/test/crashtests/audiocontext-after-unload-1.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<title>Test for bug 1646601</title>
+<script>
+document.addEventListener('DOMContentLoaded', async () => {
+ const frame = document.createElement('iframe');
+ document.body.appendChild(frame);
+ frame.srcdoc = '<html></html>';
+ await new Promise(resolve => frame.onload = resolve);
+ const subwin = frame.contentWindow;
+ const subcontext = subwin.AudioContext;
+ // Construct an AudioContext while the subdocument is fully active to start
+ // a MediaTrackGraph.
+ new subcontext();
+ // Unload the subdocument and wait for completion.
+ // This shuts down the MediaTrackGraph.
+ subwin.location.reload();
+ await new Promise(resolve => frame.onload = resolve);
+ // Test that a new AudioContext on the inactive subdocument does not attempt
+ // to use the shut-down MediaTrackGraph.
+ try { new subcontext() } catch {}
+ document.documentElement.removeAttribute('class');
+});
+</script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/audiocontext-after-xhr.html b/dom/media/test/crashtests/audiocontext-after-xhr.html
new file mode 100644
index 0000000000..a4dd9990ca
--- /dev/null
+++ b/dom/media/test/crashtests/audiocontext-after-xhr.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script>
+ document.addEventListener('DOMContentLoaded', () => {
+ const xhr = new XMLHttpRequest()
+ xhr.open('G', '', false)
+ xhr.send()
+ window.ac = new AudioContext()
+ })
+ </script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/audiocontext-double-suspend.html b/dom/media/test/crashtests/audiocontext-double-suspend.html
new file mode 100644
index 0000000000..98399549bd
--- /dev/null
+++ b/dom/media/test/crashtests/audiocontext-double-suspend.html
@@ -0,0 +1,5 @@
+<script>
+var ac = new AudioContext();
+ac.resume();
+ac.resume();
+</script>
diff --git a/dom/media/test/crashtests/audioworkletnode-after-unload-1.html b/dom/media/test/crashtests/audioworkletnode-after-unload-1.html
new file mode 100644
index 0000000000..7da8d1161a
--- /dev/null
+++ b/dom/media/test/crashtests/audioworkletnode-after-unload-1.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<title>Test for bug 1634200 and bug 1655544</title>
+<script>
+document.addEventListener('DOMContentLoaded', async () => {
+ const frame = document.createElement('iframe');
+ document.body.appendChild(frame);
+ frame.srcdoc = '<html></html>';
+ await new Promise(resolve => frame.onload = resolve);
+
+ const subwin = frame.contentWindow;
+ const ctx = new subwin.AudioContext();
+ const url = URL.createObjectURL(
+ new Blob([`registerProcessor("noop",
+ class extends AudioWorkletProcessor {})`]),
+ {type: "application/javascript"});
+ await ctx.audioWorklet.addModule(url);
+
+ frame.remove();
+ new subwin.AudioWorkletNode(ctx, 'noop')
+
+ document.documentElement.removeAttribute('class');
+});
+</script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/buffer-source-duration-1.html b/dom/media/test/crashtests/buffer-source-duration-1.html
new file mode 100644
index 0000000000..df8d7a37d5
--- /dev/null
+++ b/dom/media/test/crashtests/buffer-source-duration-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+const rate = 44100;
+var context = new window.OfflineAudioContext(1, 512, rate);
+var buffer = context.createBuffer(1, 128, rate);
+var source = context.createBufferSource();
+source.buffer = buffer;
+source.start(0, 0, 86400);
+context.startRendering().
+ then(function() {
+ document.documentElement.removeAttribute("class");
+ });
+</script>
diff --git a/dom/media/test/crashtests/buffer-source-ended-1.html b/dom/media/test/crashtests/buffer-source-ended-1.html
new file mode 100644
index 0000000000..de8546316c
--- /dev/null
+++ b/dom/media/test/crashtests/buffer-source-ended-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var context = new AudioContext();
+
+var source = context.createBufferSource();
+source.buffer = context.createBuffer(1, 2.0 * context.sampleRate, context.sampleRate);
+source.onended = function(e) {
+ document.documentElement.removeAttribute("class");
+}
+source.start(0.0, 1.0);
+setTimeout(
+ function() {
+ source.buffer = context.createBuffer(1, 1, context.sampleRate);
+ }, 0);
+</script>
diff --git a/dom/media/test/crashtests/buffer-source-resampling-start-1.html b/dom/media/test/crashtests/buffer-source-resampling-start-1.html
new file mode 100644
index 0000000000..55db8591ed
--- /dev/null
+++ b/dom/media/test/crashtests/buffer-source-resampling-start-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+const rate = 44101; // not divisible by 2
+var context = new window.OfflineAudioContext(1, 512, rate);
+var buffer = context.createBuffer(1, 128, rate);
+buffer.getChannelData(0)[0] = 1.0;
+var source = context.createBufferSource();
+source.buffer = buffer;
+source.playbackRate.value = rate / (Math.pow(2, 30) * 1.0000001);
+source.start(512 / rate);
+context.startRendering().
+ then(function() {
+ document.documentElement.removeAttribute("class");
+ });
+</script>
diff --git a/dom/media/test/crashtests/buffer-source-slow-resampling-1.html b/dom/media/test/crashtests/buffer-source-slow-resampling-1.html
new file mode 100644
index 0000000000..5d8a50442b
--- /dev/null
+++ b/dom/media/test/crashtests/buffer-source-slow-resampling-1.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+const blockSize = 128;
+// The sample rate is a prime number so that the resampler is not expected to
+// simplify in/out fractions.
+const rate = 44101;
+var context = new window.OfflineAudioContext(1, 3 * blockSize, rate);
+// Non-zero buffer, so it can't be optimized away.
+var buffer = context.createBuffer(1, 128, rate);
+buffer.getChannelData(0)[0] = 1.0;
+var source = context.createBufferSource();
+source.buffer = buffer;
+source.loop = true;
+// Initialize the resampler with a slow input rate.
+// With the current (Mar 2017) implementation, very slow rates give the
+// resampler a very large denominator.
+source.playbackRate.setValueAtTime(rate / 0x7fffffff, 0.0);
+// Change to a moderate input rate.
+// With the current implementation, skip_frac_num increases by den_rate for
+// each output sample and so one block before the change in playback rate is
+// enough for high skip_frac_num at the time of the change.
+const changeBlock = 1;
+const changeBlockSeconds = changeBlock * blockSize / rate;
+// With the current speex_resampler_set_rate_frac() implementation, the
+// moderate resampler denominator is still large enough to trigger overflow of
+// 32-bit unsigned integer arithmetic.
+source.playbackRate.setValueAtTime(rate / (rate + 1), changeBlockSeconds);
+source.start(0);
+context.startRendering().
+ then(function() {
+ document.documentElement.removeAttribute("class");
+ });
+</script>
diff --git a/dom/media/test/crashtests/channel-count-in-metadata-different-than-in-content.mp4 b/dom/media/test/crashtests/channel-count-in-metadata-different-than-in-content.mp4
new file mode 100644
index 0000000000..92bf3722f2
--- /dev/null
+++ b/dom/media/test/crashtests/channel-count-in-metadata-different-than-in-content.mp4
Binary files differ
diff --git a/dom/media/test/crashtests/convolver-memory-report-1.html b/dom/media/test/crashtests/convolver-memory-report-1.html
new file mode 100644
index 0000000000..a49a281d1c
--- /dev/null
+++ b/dom/media/test/crashtests/convolver-memory-report-1.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+ <title>Bug 1481745: Exercise ConvolverNode memory reporting</title>
+ <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+ <script>
+let context = new AudioContext();
+let response = new AudioBuffer({length: 128,
+ sampleRate: context.sampleRate});
+response.getChannelData(0)[response.length - 1] = 1;
+let convolver = new ConvolverNode(context,
+ {disableNormalization: true,
+ buffer: response});
+convolver.connect(context.destination);
+let osc = new OscillatorNode(context);
+osc.connect(convolver);
+osc.start();
+osc.stop(128/context.sampleRate);
+osc.onended = (e) => {
+ SpecialPowers.getMemoryReports();
+ document.documentElement.removeAttribute("class");
+};
+ </script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/copyFromChannel-2.html b/dom/media/test/crashtests/copyFromChannel-2.html
new file mode 100644
index 0000000000..8d3d5a2124
--- /dev/null
+++ b/dom/media/test/crashtests/copyFromChannel-2.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <title>Crashtest for bug 1548816</title>
+ <script>
+let cx = new OfflineAudioContext({numberOfChannels: 1,
+ length: 1, sampleRate: 44100});
+let buffer = new AudioBuffer({numberOfChannels: 13,
+ length: 22050, sampleRate: 44100});
+buffer.getChannelData(12)[0] = 1.0;
+let o2248 = new AudioBufferSourceNode(cx, {buffer: buffer});
+let array = new Float32Array(52428);
+buffer.copyFromChannel(array, 12);
+ </script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/cors.webm b/dom/media/test/crashtests/cors.webm
new file mode 100644
index 0000000000..72b0297233
--- /dev/null
+++ b/dom/media/test/crashtests/cors.webm
Binary files differ
diff --git a/dom/media/test/crashtests/cors.webm^headers^ b/dom/media/test/crashtests/cors.webm^headers^
new file mode 100644
index 0000000000..cb762eff80
--- /dev/null
+++ b/dom/media/test/crashtests/cors.webm^headers^
@@ -0,0 +1 @@
+Access-Control-Allow-Origin: *
diff --git a/dom/media/test/crashtests/crashtests.list b/dom/media/test/crashtests/crashtests.list
new file mode 100644
index 0000000000..0a420d9e1f
--- /dev/null
+++ b/dom/media/test/crashtests/crashtests.list
@@ -0,0 +1,169 @@
+skip-if(OSX) load 1185191.html # this needs to run near the beginning of the test suite
+load 0-timescale.html # bug 1229166
+skip-if(Android) pref(media.autoplay.default,0) load 459439-1.html # bug 888557
+load 466607-1.html
+load 466945-1.html
+load 468763-1.html
+load 474744-1.html
+HTTP load 481136-1.html # needs to be HTTP to recognize the ogg as an audio file?
+load 492286-1.xhtml
+load 493915-1.html
+pref(media.autoplay.default,0) load 495794-1.html
+load 497734-1.xhtml
+load 497734-2.html
+load 576612-1.html
+load 752784-1.html
+skip-if(Android) load 789075-1.html # bug 1374405 for android
+skip-if(Android&&AndroidVersion=='22') HTTP load 795892-1.html # bug 1358718
+load 844563.html
+load 846612.html
+load 852838.html
+load 865004.html
+load 865537-1.html
+load 865550.html
+load 868504.html
+load 874869.html
+load 874915.html
+load 874934.html
+load 874952.html
+load 875144.html
+load 875596.html
+load 875911.html
+load 876024-1.html
+load 876024-2.html
+load 876118.html
+load 876207.html
+load 876215.html
+load 876249.html
+load 876252.html
+load 876834.html
+load 877527.html
+load 877820.html
+load 878014.html
+load 878328.html
+load 878407.html
+load 878478.html
+load 880129.html
+load 880202.html
+load 880342-1.html
+load 880342-2.html
+load 880384.html
+load 880404.html
+load 880724.html
+load 881775.html
+load 882956.html
+load 884459.html
+load 889042.html
+load 907986-1.html
+load 907986-2.html
+load 907986-3.html
+load 907986-4.html
+load 910171-1.html
+load 920987.html
+load 925619-1.html
+load 925619-2.html
+load 926619.html
+load 933151.html
+load 933156.html
+load 944851.html
+load 952756.html
+load 986901.html
+load 990794.html
+load 995289.html
+load 1012609.html
+load 1015662.html
+skip-if(Android) test-pref(media.navigator.permission.disabled,true) load 1028458.html # bug 1048863
+load 1041466.html
+load 1045650.html
+load 1080986.html
+skip-if(Android&&AndroidVersion=='21') load 1180881.html # bug 1409365
+load 1197935.html
+load 1122218.html
+load 1127188.html
+load 1157994.html
+load 1158427.html
+load 1185176.html
+load 1185192.html
+skip-if(Android) load 1257700.html # bug 1575666
+load 1267263.html
+load 1270303.html
+load 1368490.html
+load 1291702.html
+load 1378826.html
+load 1384248.html
+load 1389304.html
+load 1393272.webm
+load 1411322.html
+load 1450845.html
+load 1489160.html
+load disconnect-wrong-destination.html
+load analyser-channels-1.html
+load audiocontext-after-unload-1.html
+load audiocontext-after-xhr.html
+load audiocontext-double-suspend.html
+skip-if(Android) load audioworkletnode-after-unload-1.html # Needs secure context
+load buffer-source-duration-1.html
+load buffer-source-ended-1.html
+load buffer-source-resampling-start-1.html
+load buffer-source-slow-resampling-1.html
+load convolver-memory-report-1.html
+load copyFromChannel-2.html
+load empty-buffer-source.html
+HTTP load media-element-source-seek-1.html
+load offline-buffer-source-ended-1.html
+load oscillator-ended-1.html
+load oscillator-ended-2.html
+skip-if(Android&&AndroidVersion=='22') load video-replay-after-audio-end.html # bug 1315125, bug 1358876
+# This needs to run at the end to avoid leaking busted state into other tests.
+skip-if(Android||ThreadSanitizer) load 691096-1.html # Bug 1365451
+load 1236639.html
+test-pref(media.navigator.permission.disabled,true) test-pref(media.devices.insecure.enabled,true) test-pref(media.getusermedia.insecure.enabled,true) load 1388372.html
+load 1494073.html
+skip-if(Android) load 1526044.html # Bug 1528391
+load 1530897.webm
+skip-if(Android&&AndroidVersion<21) load encrypted-track-with-bad-sample-description-index.mp4 # Bug 1533211, unkip after bug 1550912
+load encrypted-track-without-tenc.mp4 # Bug 1533215
+asserts-if(Android,0-1) load encrypted-track-with-sample-missing-cenc-aux.mp4 # Bug 1533625, bug 1588967
+load 1538727.html
+load empty-samples.webm # Bug 1540580
+test-pref(media.autoplay.block-webaudio,false) load 1545133.html
+load track-with-zero-dimensions.mp4 # Bug 1542539
+load 1560215.html
+skip-if(Android) load 1547784.html # Skip on Android as clearkey is not supported
+load 1547899.html
+load 1569645.html
+load 1575271.html
+load 1577184.html
+pref(media.autoplay.default,0) load 1587248.html
+load 1594466.html
+load 1601385.html
+load 1601422.html
+load 1604941.html
+pref(media.autoplay.default,0) load 1673525.html
+skip-if(!winWidget) load 1608286.html
+load channel-count-in-metadata-different-than-in-content.mp4 # Bug 1584959
+load mp4_box_emptyrange.mp4 # Bug 1667480
+load 1673526-1.html
+load 1673526-2.html
+load 1693043.html
+load 1696511.html
+load 1697521.html
+load 1708790.html
+skip-if(cocoaWidget) load 1709130.html # video failed decoding on MacOS, 1709684
+skip-if(appleSilicon) load 1517199.html
+load 1734008.html
+load 1741677.html
+load 1748272.html
+load 1752917.html
+load 1762620.html
+load 1765842.html
+load adts.aac # Bug 1770073
+load 1787281.html
+load 1798778.html
+load 1830206.html
+load 1830206.html
+load 1833896.mp4
+load 1833894.mp4
+load 1835164.html
+load 1840002.webm
+load 1845350.mp4
diff --git a/dom/media/test/crashtests/disconnect-wrong-destination.html b/dom/media/test/crashtests/disconnect-wrong-destination.html
new file mode 100644
index 0000000000..515ca3c877
--- /dev/null
+++ b/dom/media/test/crashtests/disconnect-wrong-destination.html
@@ -0,0 +1,13 @@
+<script>
+ var oc = new OfflineAudioContext(1, 1, 44100);
+ var splitter = oc.createChannelSplitter(2);
+ var merger0 = oc.createChannelMerger(2);
+ var merger1 = oc.createChannelMerger(2);
+ splitter.connect(merger0, 0);
+ splitter.connect(merger0, 1);
+ splitter.connect(merger1, 0);
+ splitter.connect(merger1, 1);
+
+ splitter.disconnect(merger0, 0);
+ splitter.disconnect(merger1, 1);
+</script>
diff --git a/dom/media/test/crashtests/doppler-1.html b/dom/media/test/crashtests/doppler-1.html
new file mode 100644
index 0000000000..2af3c8f460
--- /dev/null
+++ b/dom/media/test/crashtests/doppler-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var context = new window.AudioContext();
+var source = context.createBufferSource();
+source.buffer = context.createBuffer(1, 1, context.sampleRate);
+source.onended =
+ function(e) {
+ setTimeout(
+ function() {
+ var panner = context.createPanner();
+ source.connect(panner);
+ panner.setVelocity(1.0, 0.0, 0.0);
+ setTimeout(
+ function() {
+ document.documentElement.removeAttribute("class");
+ },
+ 0);
+ },
+ 0);
+ };
+source.start(0);
+</script>
diff --git a/dom/media/test/crashtests/empty-buffer-source.html b/dom/media/test/crashtests/empty-buffer-source.html
new file mode 100644
index 0000000000..2ce48a9ec1
--- /dev/null
+++ b/dom/media/test/crashtests/empty-buffer-source.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+ <title>Bug 1636540: AudioBufferSourceNode with empty buffer</title>
+ <script>
+const offline = new OfflineAudioContext({length: 128, sampleRate: 16384});
+const buffer = new AudioBuffer({length: 1, sampleRate: 21725});
+const node = new AudioBufferSourceNode(offline, {buffer: buffer});
+node.start(5/offline.sampleRate);
+offline.startRendering().then(
+ () => document.documentElement.removeAttribute("class"));
+ </script>
+</head>
+</html>
diff --git a/dom/media/test/crashtests/empty-samples.webm b/dom/media/test/crashtests/empty-samples.webm
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/dom/media/test/crashtests/empty-samples.webm
diff --git a/dom/media/test/crashtests/encrypted-track-with-bad-sample-description-index.mp4 b/dom/media/test/crashtests/encrypted-track-with-bad-sample-description-index.mp4
new file mode 100644
index 0000000000..32303f0357
--- /dev/null
+++ b/dom/media/test/crashtests/encrypted-track-with-bad-sample-description-index.mp4
Binary files differ
diff --git a/dom/media/test/crashtests/encrypted-track-with-sample-missing-cenc-aux.mp4 b/dom/media/test/crashtests/encrypted-track-with-sample-missing-cenc-aux.mp4
new file mode 100644
index 0000000000..875c5dca76
--- /dev/null
+++ b/dom/media/test/crashtests/encrypted-track-with-sample-missing-cenc-aux.mp4
Binary files differ
diff --git a/dom/media/test/crashtests/encrypted-track-without-tenc.mp4 b/dom/media/test/crashtests/encrypted-track-without-tenc.mp4
new file mode 100644
index 0000000000..188faebf1b
--- /dev/null
+++ b/dom/media/test/crashtests/encrypted-track-without-tenc.mp4
Binary files differ
diff --git a/dom/media/test/crashtests/media-element-source-seek-1.html b/dom/media/test/crashtests/media-element-source-seek-1.html
new file mode 100644
index 0000000000..5c3aed5ae7
--- /dev/null
+++ b/dom/media/test/crashtests/media-element-source-seek-1.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var audioElement = document.createElement("audio");
+audioElement.autoplay = true;
+audioElement.src = "sound.ogg";
+audioElement.onplaying =
+ function() {
+ audioElement.onplaying = null;
+ setTimeout(
+ function() {
+ audioElement.onseeked =
+ function() {
+ // Note we reset 'src' to release decoder resources and cubeb
+ // streams to prevent OOM or OpenCubeb() failures.
+ audioElement.src = "";
+ document.documentElement.removeAttribute("class");
+ };
+ audioElement.currentTime = 0;
+ }, 100);
+ };
+
+var context = new window.AudioContext();
+var source = context.createMediaElementSource(audioElement);
+source.connect(context.destination);
+</script>
+</html>
diff --git a/dom/media/test/crashtests/mp4_box_emptyrange.mp4 b/dom/media/test/crashtests/mp4_box_emptyrange.mp4
new file mode 100644
index 0000000000..83057533a0
--- /dev/null
+++ b/dom/media/test/crashtests/mp4_box_emptyrange.mp4
Binary files differ
diff --git a/dom/media/test/crashtests/offline-buffer-source-ended-1.html b/dom/media/test/crashtests/offline-buffer-source-ended-1.html
new file mode 100644
index 0000000000..0631021126
--- /dev/null
+++ b/dom/media/test/crashtests/offline-buffer-source-ended-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var context = new window.OfflineAudioContext(1, 12001, 12000);
+
+var source = context.createBufferSource();
+source.buffer = context.createBuffer(1, 12000, context.sampleRate);
+source.onended = function(e) {
+ document.documentElement.removeAttribute("class");
+}
+source.connect(context.destination);
+source.start(0);
+
+context.startRendering();
+</script>
diff --git a/dom/media/test/crashtests/oscillator-ended-1.html b/dom/media/test/crashtests/oscillator-ended-1.html
new file mode 100644
index 0000000000..831111261c
--- /dev/null
+++ b/dom/media/test/crashtests/oscillator-ended-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+function createContext() {
+ var context = new window.AudioContext();
+ var source = context.createOscillator();
+ source.onended = function(e) {
+ document.documentElement.removeAttribute("class");
+ };
+ source.connect(context.destination);
+ source.start(0.49);
+ source.stop(0.5);
+}
+createContext();
+</script>
diff --git a/dom/media/test/crashtests/oscillator-ended-2.html b/dom/media/test/crashtests/oscillator-ended-2.html
new file mode 100644
index 0000000000..ee9b8cf300
--- /dev/null
+++ b/dom/media/test/crashtests/oscillator-ended-2.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+function createContext() {
+ var context = new window.AudioContext();
+ var source = context.createOscillator();
+ source.onended = function(e) {
+ document.documentElement.removeAttribute("class");
+ };
+ source.connect(context.destination);
+ source.start(60);
+ source.stop(0.5);
+}
+createContext();
+</script>
diff --git a/dom/media/test/crashtests/sound.ogg b/dom/media/test/crashtests/sound.ogg
new file mode 100644
index 0000000000..edda4e9128
--- /dev/null
+++ b/dom/media/test/crashtests/sound.ogg
Binary files differ
diff --git a/dom/media/test/crashtests/test.mp4 b/dom/media/test/crashtests/test.mp4
new file mode 100644
index 0000000000..44d7ee9cbc
--- /dev/null
+++ b/dom/media/test/crashtests/test.mp4
Binary files differ
diff --git a/dom/media/test/crashtests/track-with-zero-dimensions.mp4 b/dom/media/test/crashtests/track-with-zero-dimensions.mp4
new file mode 100644
index 0000000000..3f4a1317f3
--- /dev/null
+++ b/dom/media/test/crashtests/track-with-zero-dimensions.mp4
Binary files differ
diff --git a/dom/media/test/crashtests/video-crash.webm b/dom/media/test/crashtests/video-crash.webm
new file mode 100644
index 0000000000..9532113d87
--- /dev/null
+++ b/dom/media/test/crashtests/video-crash.webm
Binary files differ
diff --git a/dom/media/test/crashtests/video-replay-after-audio-end.html b/dom/media/test/crashtests/video-replay-after-audio-end.html
new file mode 100644
index 0000000000..9ffd6078de
--- /dev/null
+++ b/dom/media/test/crashtests/video-replay-after-audio-end.html
@@ -0,0 +1,43 @@
+<html class="reftest-wait">
+<head>
+ <title> Bug 1242774 : video crashed if pause and play again after audio track ends </title>
+</head>
+<body>
+<script type="text/javascript">
+function assert(value, msg) {
+ if (!value) {
+ dump("### Error : " + msg + "\n");
+ }
+}
+
+var AUDIO_END_TIME = 4.5;
+var video = document.createElement('video');
+video.src = "video-crash.webm";
+video.play();
+
+video.ontimeupdate = function () {
+ assert(AUDIO_END_TIME < video.duration,
+ "AUDIO_END_TIME should be smaller than the duration!");
+
+ if (video.currentTime > AUDIO_END_TIME) {
+ dump("### Pause video during silent part.\n");
+ video.ontimeupdate = null;
+ video.pause();
+ }
+
+ video.onpause = function () {
+ video.onpause = null;
+ setTimeout(function() {
+ dump("### Re-play after pausing during silent part.\n");
+ video.play();
+ video.onended = function () {
+ video.onended = null;
+ dump("### Video is ended.\n");
+ document.documentElement.removeAttribute("class");
+ }
+ }, 1000);
+ }
+}
+</script>
+</body>
+</html> \ No newline at end of file