summaryrefslogtreecommitdiffstats
path: root/dom/canvas/crashtests
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 19:33:14 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 19:33:14 +0000
commit36d22d82aa202bb199967e9512281e9a53db42c9 (patch)
tree105e8c98ddea1c1e4784a60a5a6410fa416be2de /dom/canvas/crashtests
parentInitial commit. (diff)
downloadfirefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.tar.xz
firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.zip
Adding upstream version 115.7.0esr.upstream/115.7.0esrupstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'dom/canvas/crashtests')
-rw-r--r--dom/canvas/crashtests/0px-size-font-667225.html19
-rw-r--r--dom/canvas/crashtests/0px-size-font-shadow.html17
-rw-r--r--dom/canvas/crashtests/1099143-1.html5
-rw-r--r--dom/canvas/crashtests/1161277-1.html22
-rw-r--r--dom/canvas/crashtests/1183363.html23
-rw-r--r--dom/canvas/crashtests/1190705.html17
-rw-r--r--dom/canvas/crashtests/1223740-1.html22
-rw-r--r--dom/canvas/crashtests/1225381-1.html17
-rw-r--r--dom/canvas/crashtests/1229932-1.html16
-rw-r--r--dom/canvas/crashtests/1229983-1.html24
-rw-r--r--dom/canvas/crashtests/1233613.html19
-rw-r--r--dom/canvas/crashtests/1244850-1.html22
-rw-r--r--dom/canvas/crashtests/1246775-1.html15
-rw-r--r--dom/canvas/crashtests/1283113-1.html25
-rw-r--r--dom/canvas/crashtests/1284356-1.html9
-rw-r--r--dom/canvas/crashtests/1284578-1.html8
-rw-r--r--dom/canvas/crashtests/1286458-1.html20
-rw-r--r--dom/canvas/crashtests/1287515-1.html7
-rw-r--r--dom/canvas/crashtests/1287652-1.html8
-rw-r--r--dom/canvas/crashtests/1288872-1.html6
-rw-r--r--dom/canvas/crashtests/1290628-1.html13
-rw-r--r--dom/canvas/crashtests/1296410-1.html9
-rw-r--r--dom/canvas/crashtests/1298576-1.html21
-rw-r--r--dom/canvas/crashtests/1299062-1.html5
-rw-r--r--dom/canvas/crashtests/1305085-1.html9
-rw-r--r--dom/canvas/crashtests/1305312-1.html5
-rw-r--r--dom/canvas/crashtests/1305850.html11
-rw-r--r--dom/canvas/crashtests/1334366-1.html8
-rw-r--r--dom/canvas/crashtests/1334647-1.html8
-rw-r--r--dom/canvas/crashtests/1348976-1.html13
-rw-r--r--dom/canvas/crashtests/1349067.html10
-rw-r--r--dom/canvas/crashtests/1357092.html10
-rw-r--r--dom/canvas/crashtests/1441613.html19
-rw-r--r--dom/canvas/crashtests/1443671.html8
-rw-r--r--dom/canvas/crashtests/1546390.html11
-rw-r--r--dom/canvas/crashtests/1549853.html8
-rw-r--r--dom/canvas/crashtests/1551745.html9
-rw-r--r--dom/canvas/crashtests/1569648.html5
-rw-r--r--dom/canvas/crashtests/1654477.html26
-rw-r--r--dom/canvas/crashtests/1739454-1.html17
-rw-r--r--dom/canvas/crashtests/1740031.html12
-rw-r--r--dom/canvas/crashtests/1744172.html17
-rw-r--r--dom/canvas/crashtests/1757755.html18
-rw-r--r--dom/canvas/crashtests/1757925-1.html15
-rw-r--r--dom/canvas/crashtests/1769878.html15
-rw-r--r--dom/canvas/crashtests/1771007-1.html22
-rw-r--r--dom/canvas/crashtests/1816140.html17
-rw-r--r--dom/canvas/crashtests/360293-1.html35
-rw-r--r--dom/canvas/crashtests/421715-1.html41
-rw-r--r--dom/canvas/crashtests/553938-1.html20
-rw-r--r--dom/canvas/crashtests/647480.html102
-rw-r--r--dom/canvas/crashtests/727547.html7
-rw-r--r--dom/canvas/crashtests/729116.html18
-rw-r--r--dom/canvas/crashtests/743499-negative-size.html22
-rw-r--r--dom/canvas/crashtests/745699-1.html25
-rw-r--r--dom/canvas/crashtests/745818-large-source.html21
-rw-r--r--dom/canvas/crashtests/746813-1.html6
-rw-r--r--dom/canvas/crashtests/767337-1.html21
-rw-r--r--dom/canvas/crashtests/779426.html19
-rw-r--r--dom/canvas/crashtests/780392-1.html10
-rw-r--r--dom/canvas/crashtests/789933-1.html13
-rw-r--r--dom/canvas/crashtests/794463-1.html17
-rw-r--r--dom/canvas/crashtests/802926-1.html6
-rw-r--r--dom/canvas/crashtests/844280.html18
-rw-r--r--dom/canvas/crashtests/896047-1.html17
-rw-r--r--dom/canvas/crashtests/896047-2.html19
-rw-r--r--dom/canvas/crashtests/916128-1.html13
-rw-r--r--dom/canvas/crashtests/934939-1.html8
-rw-r--r--dom/canvas/crashtests/989628.html9
-rw-r--r--dom/canvas/crashtests/crashtests.list67
-rw-r--r--dom/canvas/crashtests/texImage2D.html8
71 files changed, 1204 insertions, 0 deletions
diff --git a/dom/canvas/crashtests/0px-size-font-667225.html b/dom/canvas/crashtests/0px-size-font-667225.html
new file mode 100644
index 0000000000..9de65f8f59
--- /dev/null
+++ b/dom/canvas/crashtests/0px-size-font-667225.html
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml" >
+<script language=javascript>
+
+function draw() {
+ var canv = document.getElementById("canv");
+ var ctx = canv.getContext("2d");
+
+ ctx.fillStyle = "red";
+ // 0 size font shouldn't crash!
+ ctx.font = "0px Arial";
+ ctx.fillText("A", 0, 0);
+ document.documentElement.className = "";
+}
+
+</script>
+<body onload="draw()">
+<canvas id="canv" width="5" height="5"></canvas>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/0px-size-font-shadow.html b/dom/canvas/crashtests/0px-size-font-shadow.html
new file mode 100644
index 0000000000..1298f3fa1e
--- /dev/null
+++ b/dom/canvas/crashtests/0px-size-font-shadow.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<body>
+<canvas id="canv" width="5" height="5"></canvas>
+<script>
+var canv = document.getElementById("canv");
+var ctx = canv.getContext("2d");
+
+ctx.fillStyle = "red";
+// 0 size font shouldn't assert!
+ctx.font = "0px Arial";
+ctx.shadowColor = '#f00';
+ctx.shadowBlur = 4;
+ctx.fillText("A", 0, 0);
+document.documentElement.className = "";
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/1099143-1.html b/dom/canvas/crashtests/1099143-1.html
new file mode 100644
index 0000000000..30bb3a0033
--- /dev/null
+++ b/dom/canvas/crashtests/1099143-1.html
@@ -0,0 +1,5 @@
+<script>
+ var canvas = document.createElement("canvas");
+ var context = canvas.getContext("2d");
+ context.fillText("", 0, 0);
+</script>
diff --git a/dom/canvas/crashtests/1161277-1.html b/dom/canvas/crashtests/1161277-1.html
new file mode 100644
index 0000000000..3e04dc46da
--- /dev/null
+++ b/dom/canvas/crashtests/1161277-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var canvas = document.createElement('canvas');
+ var ctx = canvas.getContext('2d');
+ ctx.setTransform(0.2988847856952777, 26589683732.25, -562949953421312, 5, 4503599627370495, -2735897607.139075);
+ ctx.bezierCurveTo(-1023, -4611686018427388000, 4194303, -536870911, 45139.65058316886, 35184372088833);
+ ctx.setLineDash([1.2307692307692308]);
+ ctx.setTransform(0, 2097152, 0.0005128205128205128, 305943.4982061649, -49282.263290019946, 3);
+ ctx.clip("evenodd");
+ ctx.scale(-2.3882113703861325, -2);
+ ctx.isPointInStroke(2, 86124313031369.77);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/1183363.html b/dom/canvas/crashtests/1183363.html
new file mode 100644
index 0000000000..2044a80928
--- /dev/null
+++ b/dom/canvas/crashtests/1183363.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var ctx = canvas.getContext('2d');
+ ctx.rect(2, 6, 9, 8);
+ ctx.setTransform(1, 2, 3, 0, 4, 1);
+ setTimeout(function() {
+ ctx.moveTo(0, 1);
+ ctx.isPointInPath(0, 0, 'evenodd');
+ }, 0);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<canvas id="canvas"></canvas>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/1190705.html b/dom/canvas/crashtests/1190705.html
new file mode 100644
index 0000000000..64795decb6
--- /dev/null
+++ b/dom/canvas/crashtests/1190705.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var canvas = document.createElement('canvas');
+ var ctx = canvas.getContext('2d');
+ ctx.rotate(1e308);
+ ctx.fillText("A", 1, 1);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/1223740-1.html b/dom/canvas/crashtests/1223740-1.html
new file mode 100644
index 0000000000..d5d9696935
--- /dev/null
+++ b/dom/canvas/crashtests/1223740-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom() {
+ var canvas = document.createElement('canvas');
+ var ctx = canvas.getContext('2d');
+ ctx.shadowColor = "green";
+ ctx.rotate(0.9923);
+ ctx.transform(6, 0.13807760834183488, 256, -0.39007851257689263, 0.5767177072299453, 64);
+ ctx.transform(0.61, 0.08697788582345888, 6, 6, 64, 128);
+ ctx.scale(0.36690500480283633, 6);
+ ctx.shadowOffsetY = -1.7976931348623157e+308;
+ ctx.fillText("A",32,0.848476537933684);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/1225381-1.html b/dom/canvas/crashtests/1225381-1.html
new file mode 100644
index 0000000000..5d76be9fae
--- /dev/null
+++ b/dom/canvas/crashtests/1225381-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom() {
+ var canvas = document.createElement('canvas');
+ var ctx = canvas.getContext('2d');
+ ctx.setTransform(new DOMMatrix([32, -1, 0.8320478957221024, 1.7976931348623157e+308, 512, 0.9012573524148337]).invertSelf());
+ ctx.fillText("A", 0 ,0);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/1229932-1.html b/dom/canvas/crashtests/1229932-1.html
new file mode 100644
index 0000000000..b5f06ff85c
--- /dev/null
+++ b/dom/canvas/crashtests/1229932-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom() {
+ var canvas = document.createElement('canvas');
+ var ctx = canvas.getContext('2d');
+ ctx.fillText("A", 0, 1e308);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/1229983-1.html b/dom/canvas/crashtests/1229983-1.html
new file mode 100644
index 0000000000..a865c569e4
--- /dev/null
+++ b/dom/canvas/crashtests/1229983-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom() {
+ var canvas = document.createElement('canvas');
+ var ctx = canvas.getContext('2d');
+ ctx.lineJoin = 'round';
+ ctx.transform(18.5, 41.6, 447, 78.2, 85.75, 120.5);
+ ctx.transform(186.25, 26.142857142857142, 251.5, -562949953421311, 147, 4.625);
+ ctx.rotate(32);
+ ctx.arc(33.8, 1, 183, 141.5, 452.5, 0);
+ ctx.transform(423, 24.75, 78, 12, 180.25, 191.5);
+ ctx.shadowBlur = 31.5;
+ ctx.shadowColor = "blue";
+ ctx.stroke();
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/1233613.html b/dom/canvas/crashtests/1233613.html
new file mode 100644
index 0000000000..d949c3b21c
--- /dev/null
+++ b/dom/canvas/crashtests/1233613.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<iframe style="display:none" srcdoc="
+
+<html>
+<head>
+<script type='text/javascript'>
+function boom() {
+ var gl = canvas.getContext('experimental-webgl');
+ video.srcObject = canvas.captureStream(0);
+}
+</script>
+</head>
+<body onload='boom();'>
+ <video id='video' width='256' height='256'></video>
+ <canvas id='canvas' width='256' height='256'></canvas>
+</body>
+</html>
+
+"></iframe>
diff --git a/dom/canvas/crashtests/1244850-1.html b/dom/canvas/crashtests/1244850-1.html
new file mode 100644
index 0000000000..015baf2c03
--- /dev/null
+++ b/dom/canvas/crashtests/1244850-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ var canvas = document.createElement('canvas');
+ var ctx = canvas.getContext('2d');
+ var svgImage = document.getElementsByTagName("img")[0];
+ ctx.drawImage(svgImage, 1e+308, 0);
+}
+
+</script>
+</head>
+<body onload="boom();">
+
+<img src="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' width='100' height='100'><rect width='100' height='100' fill='blue'/></svg>">
+
+</body>
+</html>
diff --git a/dom/canvas/crashtests/1246775-1.html b/dom/canvas/crashtests/1246775-1.html
new file mode 100644
index 0000000000..8c4ddabdf8
--- /dev/null
+++ b/dom/canvas/crashtests/1246775-1.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+<script>
+function boom()
+{
+ var canvas = document.getElementById("canvas");
+ var ctx = SpecialPowers.wrap(canvas.getContext("2d"));
+ ctx.drawWindow(window, 0, 0, canvas.width, canvas.height, "red");
+}
+</script>
+</head>
+<body onload="boom();">
+<canvas id="canvas" width="10" height="10"></canvas>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/1283113-1.html b/dom/canvas/crashtests/1283113-1.html
new file mode 100644
index 0000000000..50234169be
--- /dev/null
+++ b/dom/canvas/crashtests/1283113-1.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var canvas = document.createElement('canvas');
+ var ctx = canvas.getContext('2d');
+ ctx.transform(1,1,0,0,0,0);
+ ctx.scale(610.561277214,0.0);
+ ctx.scale(442.538892637,64.9064087241);
+ ctx.scale(851.176724189,322.349092655);
+ ctx.scale(862.937434575,2.88757032711);
+ ctx.scale(230.933492526,766.024348731);
+ ctx.scale(968.538114712,4.580);
+ ctx.transform(1,0,1,0,1,0);
+ ctx.scale(341.640607159,753.362567174);
+ ctx.measureText('');
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/1284356-1.html b/dom/canvas/crashtests/1284356-1.html
new file mode 100644
index 0000000000..bbdb135b0e
--- /dev/null
+++ b/dom/canvas/crashtests/1284356-1.html
@@ -0,0 +1,9 @@
+<canvas id='i0'></canvas>
+<script>
+var c=document.getElementById('i0').getContext('2d');
+c.lineWidth=194.622602174;
+c.miterLimit=270.273509738;
+c.transform(0,0,0,0,0,0);
+c.globalCompositeOperation='soft-light';
+c.strokeText('a',200,273,722);
+</script> \ No newline at end of file
diff --git a/dom/canvas/crashtests/1284578-1.html b/dom/canvas/crashtests/1284578-1.html
new file mode 100644
index 0000000000..ba6e5f9630
--- /dev/null
+++ b/dom/canvas/crashtests/1284578-1.html
@@ -0,0 +1,8 @@
+<canvas id='i0'></canvas>
+<script>
+var c=document.getElementById('i0').getContext('2d');
+c.bezierCurveTo(157,351,351,44,946,701);
+c.quadraticCurveTo(260,-9007199254740991,945,145);
+c.translate(-9007199254740991,239);
+c.isPointInPath(988,439);
+</script> \ No newline at end of file
diff --git a/dom/canvas/crashtests/1286458-1.html b/dom/canvas/crashtests/1286458-1.html
new file mode 100644
index 0000000000..1241a5f0ed
--- /dev/null
+++ b/dom/canvas/crashtests/1286458-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var canvas = document.createElement('canvas');
+ var ctx = canvas.getContext('2d');
+ var path=new Path2D();
+ path.bezierCurveTo(436,Number.MIN_VALUE,620,Number.MAX_SAFE_INTEGER,1,83);
+ ctx.setTransform(1,Number.MAX_SAFE_INTEGER,1,0,1,146.0);
+ ctx.scale(16777218,55);
+ ctx.stroke(path);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/1287515-1.html b/dom/canvas/crashtests/1287515-1.html
new file mode 100644
index 0000000000..37dc8a2a0a
--- /dev/null
+++ b/dom/canvas/crashtests/1287515-1.html
@@ -0,0 +1,7 @@
+<canvas id='i0'></canvas>
+<script>
+var c=document.getElementById('i0').getContext('2d');
+c.lineWidth=Number.MAX_SAFE_INTEGER;
+c.setLineDash([1]);
+c.strokeRect(1,1,0,Number.MIN_SAFE_INTEGER);
+</script>
diff --git a/dom/canvas/crashtests/1287652-1.html b/dom/canvas/crashtests/1287652-1.html
new file mode 100644
index 0000000000..7eaccd58a3
--- /dev/null
+++ b/dom/canvas/crashtests/1287652-1.html
@@ -0,0 +1,8 @@
+<canvas id='i0'></canvas>
+<script>
+var c=document.getElementById('i0').getContext('2d');
+var g=c.createLinearGradient(59,9,38.89,-75.51);
+c.fillStyle=g;
+c.globalAlpha=0.62;
+c.fillText('a',0,24,30);
+</script>
diff --git a/dom/canvas/crashtests/1288872-1.html b/dom/canvas/crashtests/1288872-1.html
new file mode 100644
index 0000000000..de57311a55
--- /dev/null
+++ b/dom/canvas/crashtests/1288872-1.html
@@ -0,0 +1,6 @@
+<canvas id='id0'></canvas>
+<script>
+var c=document.getElementById('id0').getContext('2d');
+c.transform(1,0,1,0,0,0);
+c.fillText('A',0,53);
+</script> \ No newline at end of file
diff --git a/dom/canvas/crashtests/1290628-1.html b/dom/canvas/crashtests/1290628-1.html
new file mode 100644
index 0000000000..a2502f70af
--- /dev/null
+++ b/dom/canvas/crashtests/1290628-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<body id='test_body'>
+<canvas id='i0'></canvas>
+<script>
+var c=document.getElementById('i0').getContext('2d');
+c.shadowOffsetX=73;
+c.scale(5,55);
+c.setLineDash([48,81,88,41,32767,8]);
+c.shadowColor='hsl(1.0,1%,1%)';
+c.miterLimit=Number.MIN_VALUE;
+c.strokeRect(0,58,8589934591,0);
+</script> \ No newline at end of file
diff --git a/dom/canvas/crashtests/1296410-1.html b/dom/canvas/crashtests/1296410-1.html
new file mode 100644
index 0000000000..a282d4e0fd
--- /dev/null
+++ b/dom/canvas/crashtests/1296410-1.html
@@ -0,0 +1,9 @@
+<canvas id='canv'></canvas>
+<script>
+var ctx=document.getElementById('canv').getContext('2d');
+ctx.globalAlpha=0.81;
+ctx.scale(22,3406781);
+ctx.filter='sepia(80%)';
+ctx.font='52px serif';
+ctx.measureText('A');
+</script>
diff --git a/dom/canvas/crashtests/1298576-1.html b/dom/canvas/crashtests/1298576-1.html
new file mode 100644
index 0000000000..b3936027eb
--- /dev/null
+++ b/dom/canvas/crashtests/1298576-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script id="fshader" type="x-shader/x-fragment">
+void main() {
+ -2147483648 % 0xffffffff;
+ gl_FragColor = vec4(0.5, 0.5, 1.0, 1.0);
+}
+</script>
+</head>
+<body>
+<script>
+var gl = document.createElement('canvas').getContext('webgl');
+var program = gl.createProgram();
+var fshader = gl.createShader(gl.FRAGMENT_SHADER);
+var fshaderSource = document.getElementById("fshader").text;
+gl.shaderSource(fshader, fshaderSource);
+gl.compileShader(fshader);
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/1299062-1.html b/dom/canvas/crashtests/1299062-1.html
new file mode 100644
index 0000000000..2f33b889ad
--- /dev/null
+++ b/dom/canvas/crashtests/1299062-1.html
@@ -0,0 +1,5 @@
+<canvas id='id0' width='35376.4661501'></canvas>
+<script>
+var ctx=document.getElementById('id0').getContext('2d');
+ctx.getImageData(66,-1,32,87);
+</script>
diff --git a/dom/canvas/crashtests/1305085-1.html b/dom/canvas/crashtests/1305085-1.html
new file mode 100644
index 0000000000..017d10eb1b
--- /dev/null
+++ b/dom/canvas/crashtests/1305085-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<script>
+var c = document.createElementNS('http://www.w3.org/1999/xhtml', 'canvas');
+var cx = c.getContext('2d');
+cx.setTransform(1, 2, 2, 4, 0.41577222277777554, 0.89);
+cx.fillText("AA",2048,4);
+</script>
+</html>
diff --git a/dom/canvas/crashtests/1305312-1.html b/dom/canvas/crashtests/1305312-1.html
new file mode 100644
index 0000000000..3bd0b8c004
--- /dev/null
+++ b/dom/canvas/crashtests/1305312-1.html
@@ -0,0 +1,5 @@
+<canvas id='cid'></canvas>
+<script>
+var x=document.getElementById('cid').getContext('2d',{alpha: false});
+x.putImageData(x.createImageData(250,27434.63),Number.MAX_SAFE_INTEGER,23);
+</script> \ No newline at end of file
diff --git a/dom/canvas/crashtests/1305850.html b/dom/canvas/crashtests/1305850.html
new file mode 100644
index 0000000000..7f79905161
--- /dev/null
+++ b/dom/canvas/crashtests/1305850.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<script>
+window.onload=function(){
+ var gl = document.createElementNS("http://www.w3.org/1999/xhtml", "canvas").getContext("webgl");
+ var shader = gl.createShader(gl.FRAGMENT_SHADER);
+ gl.shaderSource(shader, 'void main(){d[vec4[]()}');
+ gl.compileShader(shader);
+};
+</script>
+</html>
diff --git a/dom/canvas/crashtests/1334366-1.html b/dom/canvas/crashtests/1334366-1.html
new file mode 100644
index 0000000000..0b7bc65d9d
--- /dev/null
+++ b/dom/canvas/crashtests/1334366-1.html
@@ -0,0 +1,8 @@
+<script>
+Logger={}; Logger.JSError=function(e){};
+try { o0 = document.createElement('canvas'); } catch(e) { Logger.JSError(e); }
+try { (document.body || document.documentElement).appendChild(o0) } catch(e) { Logger.JSError(e); }
+try { o1 = o0.getContext('2d'); } catch(e) { Logger.JSError(e); }
+try { o1.translate(1152921504606847000, 0.919677262874245) } catch(e) { Logger.JSError(e); }
+try { o1.fillText("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",0.6494016751296356,-16,0.5988693960474034) } catch(e) { Logger.JSError(e); }
+</script>
diff --git a/dom/canvas/crashtests/1334647-1.html b/dom/canvas/crashtests/1334647-1.html
new file mode 100644
index 0000000000..b4510afebb
--- /dev/null
+++ b/dom/canvas/crashtests/1334647-1.html
@@ -0,0 +1,8 @@
+<script>
+Logger={}; Logger.JSError=function(e){};
+try { o0 = document.createElement('canvas'); } catch(e) { Logger.JSError(e); }
+try { (document.body || document.documentElement).appendChild(o0) } catch(e) { Logger.JSError(e); }
+try { o1 = o0.getContext('2d'); } catch(e) { Logger.JSError(e); }
+try { o0.width = 311853383.455201; } catch(e) { Logger.JSError(e); }
+try { o1.drawImage(o0, -0.906275445340731, 0.3679144809413502, 2, 32) } catch(e) { Logger.JSError(e); }
+</script>
diff --git a/dom/canvas/crashtests/1348976-1.html b/dom/canvas/crashtests/1348976-1.html
new file mode 100644
index 0000000000..655aec1a73
--- /dev/null
+++ b/dom/canvas/crashtests/1348976-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+function boom(){
+ let c = new OffscreenCanvas(0, 0);
+ c.transferToImageBitmap();
+}
+addEventListener("DOMContentLoaded", boom);
+</script>
+</head>
+</html>
diff --git a/dom/canvas/crashtests/1349067.html b/dom/canvas/crashtests/1349067.html
new file mode 100644
index 0000000000..f8c8e0da1e
--- /dev/null
+++ b/dom/canvas/crashtests/1349067.html
@@ -0,0 +1,10 @@
+<script>
+o0 = document.createElement('canvas');
+document.documentElement.appendChild(o0)
+o2 = o0.getContext("webgl2", {"premultipliedAlpha":false,"preserveDrawingBuffer":false,"depth":false})
+o12 = document.createElement('canvas');
+(document.body || document.documentElement).appendChild(o12)
+o13 = o12.getContext('2d');
+o14 = o13.getImageData(0.4002597041894355, 128, 8, 0.6125768461759614)
+o2.readBuffer(1029)
+</script>
diff --git a/dom/canvas/crashtests/1357092.html b/dom/canvas/crashtests/1357092.html
new file mode 100644
index 0000000000..110aa7e86e
--- /dev/null
+++ b/dom/canvas/crashtests/1357092.html
@@ -0,0 +1,10 @@
+<html>
+ <head>
+ <script>
+ o1 = document.createElement("canvas");
+ o1.setAttribute("width", "100000");
+ o2 = o1.getContext("2d");
+ o2.bezierCurveTo(64, 1, 1, 1, 1, 1);
+ </script>
+ </head>
+</html>
diff --git a/dom/canvas/crashtests/1441613.html b/dom/canvas/crashtests/1441613.html
new file mode 100644
index 0000000000..c6ca8f3492
--- /dev/null
+++ b/dom/canvas/crashtests/1441613.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<iframe id="iframe" src="about:blank"></iframe>
+<script>
+iframe.onload = function() {
+ let doc = iframe.contentDocument;
+ let canvas = doc.createElement('canvas');
+ doc.body.appendChild(canvas);
+ let ctx = canvas.getContext('2d');
+ document.body.offsetTop;
+ iframe.style.display = 'none';
+ try {
+ ctx.font = '10px serif';
+ } finally {
+ document.documentElement.className = "";
+ }
+};
+</script>
+</html>
diff --git a/dom/canvas/crashtests/1443671.html b/dom/canvas/crashtests/1443671.html
new file mode 100644
index 0000000000..28a2fcd0a8
--- /dev/null
+++ b/dom/canvas/crashtests/1443671.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<script>
+try { o1 = document.createElement('canvas') } catch (e) {}
+try { o2 = o1.transferControlToOffscreen() } catch (e) {}
+try { o2.getContext("webgl", { }) } catch (e) {}
+</script>
+</html>
diff --git a/dom/canvas/crashtests/1546390.html b/dom/canvas/crashtests/1546390.html
new file mode 100644
index 0000000000..b44eb8ea47
--- /dev/null
+++ b/dom/canvas/crashtests/1546390.html
@@ -0,0 +1,11 @@
+<html>
+<head>
+ <script>
+ function start () {
+ new OffscreenCanvas(1, 127).toBlob()
+ }
+
+ window.addEventListener('load', start)
+ </script>
+</head>
+</html>
diff --git a/dom/canvas/crashtests/1549853.html b/dom/canvas/crashtests/1549853.html
new file mode 100644
index 0000000000..532430e386
--- /dev/null
+++ b/dom/canvas/crashtests/1549853.html
@@ -0,0 +1,8 @@
+<canvas id='a' height='67108864' width='80'></canvas>
+<script>
+document.addEventListener("DOMContentLoaded", function() {
+ var c=document.getElementById('a')
+ var x=c.getContext('2d', {alpha: true})
+ c.setAttribute('width', 800)
+})
+</script>
diff --git a/dom/canvas/crashtests/1551745.html b/dom/canvas/crashtests/1551745.html
new file mode 100644
index 0000000000..f7617b96ef
--- /dev/null
+++ b/dom/canvas/crashtests/1551745.html
@@ -0,0 +1,9 @@
+<script>
+window.addEventListener('load', function() {
+ b.getContext('2d')
+ a.src = b.toDataURL('image/jpeg', 0.1)
+ b.setAttribute('width', 2684354)
+})
+</script>
+<img id='a' src='data:image/gif;base64,R0lGODlhAQABAIABAP///wAAACwAAAAAAQABAAACAkQBADs='/>
+<canvas id='b' height='800' width='800'></canvas>
diff --git a/dom/canvas/crashtests/1569648.html b/dom/canvas/crashtests/1569648.html
new file mode 100644
index 0000000000..766d9fa937
--- /dev/null
+++ b/dom/canvas/crashtests/1569648.html
@@ -0,0 +1,5 @@
+<!doctype html>
+<base href="a:">
+<script>
+ document.createElement("canvas").getContext("2d").filter = "url()";
+</script>
diff --git a/dom/canvas/crashtests/1654477.html b/dom/canvas/crashtests/1654477.html
new file mode 100644
index 0000000000..5303291fe2
--- /dev/null
+++ b/dom/canvas/crashtests/1654477.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ const canvas = document.getElementById('canvas');
+ const ctx = canvas.getContext('2d');
+
+ for (let i = 0; i < 50; i++) {
+ canvas.width = 20;
+ ctx.fillStyle = 'green';
+ ctx.fillRect(1, 1, 20, 20);
+ canvas.width = 10;
+ ctx.fillStyle = 'green';
+ ctx.fillRect(1, 1, 10, 10);
+ }
+}
+
+</script>
+</head>
+<body onload="boom();">
+<canvas id="canvas"></canvas>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/1739454-1.html b/dom/canvas/crashtests/1739454-1.html
new file mode 100644
index 0000000000..a32445249d
--- /dev/null
+++ b/dom/canvas/crashtests/1739454-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+document.addEventListener('DOMContentLoaded', async () => {
+ cnv = document.createElement('canvas')
+ ctx = cnv.getContext('2d')
+ try {
+ a = await fetch('');
+ b = await a.arrayBuffer();
+ c = await self.createImageBitmap(new Blob([b]), {'premultiplyAlpha':'none'})
+ ctx.createPattern(c, 'repeat-x')
+ } finally {
+ document.documentElement.className = "";
+ }
+})
+</script>
+</html>
diff --git a/dom/canvas/crashtests/1740031.html b/dom/canvas/crashtests/1740031.html
new file mode 100644
index 0000000000..fb5d11b3fd
--- /dev/null
+++ b/dom/canvas/crashtests/1740031.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script>
+ document.addEventListener('DOMContentLoaded', () => {
+ const canvas = document.createElementNS('http://www.w3.org/1999/xhtml', 'canvas')
+ const context = canvas.getContext('webgl')
+ window.createImageBitmap(canvas, 81, 253, 1754696613, 348508165)
+ })
+ </script>
+</head>
+</html>
diff --git a/dom/canvas/crashtests/1744172.html b/dom/canvas/crashtests/1744172.html
new file mode 100644
index 0000000000..0fd6313bba
--- /dev/null
+++ b/dom/canvas/crashtests/1744172.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+
+document.addEventListener('DOMContentLoaded', () => {
+ const gl = document.createElement('canvas').getContext('webgl');
+ const a = gl.getExtension('EXT_disjoint_timer_query');
+ const b = a.createQueryEXT();
+ a.queryCounterEXT(b, a.TIMESTAMP_EXT);
+ a.deleteQueryEXT(b);
+});
+
+</script>
+</head>
+</html>
diff --git a/dom/canvas/crashtests/1757755.html b/dom/canvas/crashtests/1757755.html
new file mode 100644
index 0000000000..4e222f79cd
--- /dev/null
+++ b/dom/canvas/crashtests/1757755.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+
+window.addEventListener("load", () => {
+ const canvas = document.createElement('canvas');
+ const context = canvas.getContext("webgl");
+ const extension = context.getExtension("WEBGL_lose_context");
+ extension.loseContext();
+ extension.restoreContext();
+ canvas.height = 0;
+});
+
+</script>
+</head>
+</html>
diff --git a/dom/canvas/crashtests/1757925-1.html b/dom/canvas/crashtests/1757925-1.html
new file mode 100644
index 0000000000..c42ab9c876
--- /dev/null
+++ b/dom/canvas/crashtests/1757925-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+ window.addEventListener("load", () => {
+ const canvas = document.createElement("canvas")
+ const context = canvas.getContext("2d")
+ context.shadowColor = "#cad1"
+ context.setTransform({ "b": 2.144923254600512e+37 })
+ context.shadowOffsetY = -128
+ context.drawImage(canvas, 16, 255, 128, -128)
+ })
+ </script>
+</head>
+</html> \ No newline at end of file
diff --git a/dom/canvas/crashtests/1769878.html b/dom/canvas/crashtests/1769878.html
new file mode 100644
index 0000000000..1646f71793
--- /dev/null
+++ b/dom/canvas/crashtests/1769878.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<script id="w1">
+ self.onmessage = async () => {
+ try { self.close() } catch (e) {}
+ let a = new OffscreenCanvas(143, 178)
+ a.convertToBlob({ })
+ }
+ </script>
+<script>
+ window.addEventListener('load', async () => {
+ const blob = new Blob([document.querySelector('#w1').textContent], { type: "text/javascript" })
+ const worker = new Worker(window.URL.createObjectURL(blob))
+ worker.postMessage([], [])
+ })
+</script>
diff --git a/dom/canvas/crashtests/1771007-1.html b/dom/canvas/crashtests/1771007-1.html
new file mode 100644
index 0000000000..1e5642e3ad
--- /dev/null
+++ b/dom/canvas/crashtests/1771007-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script id="worker1" type="javascript/worker">
+ self.onmessage = async function (e) {
+ const canvas = new OffscreenCanvas(82, 127)
+ canvas.getContext('2d', {})
+ canvas.width = 134
+ await canvas.convertToBlob({})
+ canvas.transferToImageBitmap()
+ }
+ </script>
+ <script>
+ window.addEventListener('load', () => {
+ const blob = new Blob([document.querySelector('#worker1').textContent], { type: 'text/javascript' })
+ const worker = new Worker(window.URL.createObjectURL(blob))
+ worker.postMessage([], [])
+ setTimeout('self.close()', 500)
+ })
+ </script>
+</head>
+</html> \ No newline at end of file
diff --git a/dom/canvas/crashtests/1816140.html b/dom/canvas/crashtests/1816140.html
new file mode 100644
index 0000000000..3fe55cef62
--- /dev/null
+++ b/dom/canvas/crashtests/1816140.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script>
+ window.addEventListener("load", async () => {
+ const adapter = await navigator.gpu.requestAdapter({})
+ const device = await adapter.requestDevice({})
+ const canvas = new OffscreenCanvas(184, 4266759736)
+ context = canvas.getContext('webgpu')
+ context.configure({
+ device: device,
+ format: context.getPreferredFormat(adapter),
+ })
+ })
+ </script>
+</head>
+</html> \ No newline at end of file
diff --git a/dom/canvas/crashtests/360293-1.html b/dom/canvas/crashtests/360293-1.html
new file mode 100644
index 0000000000..8a0859e41b
--- /dev/null
+++ b/dom/canvas/crashtests/360293-1.html
@@ -0,0 +1,35 @@
+<html>
+
+
+<body>
+ Firefox: <a href="javascript:noCrash()">no crash</a> | <a href="javascript:crash()">crash</a><br/>
+ <canvas id="foo" width="200" height="200">
+ </canvas>
+ <script>
+ function d(lineWidth){
+ var c = document.getElementById("foo").getContext("2d")
+ c.clearRect(0,0,200,200)
+ c.lineWidth = lineWidth
+ c.beginPath()
+ c.arc(100,100,80, Math.PI, 2*Math.PI, 1)
+ c.stroke()
+ c.beginPath()
+ c.arc(50,50, 20, 0, 2*Math.PI, 1)
+ c.stroke()
+ c.beginPath()
+ c.arc(150,50, 20, 0, 2*Math.PI, 1)
+ c.stroke()
+ }
+ function noCrash() {
+ d(Math.random()*20+5)
+ }
+ function crash() {
+ d( '_' )
+ }
+
+ crash();
+ </script>
+
+</body>
+
+</html>
diff --git a/dom/canvas/crashtests/421715-1.html b/dom/canvas/crashtests/421715-1.html
new file mode 100644
index 0000000000..c2ea9b28ad
--- /dev/null
+++ b/dom/canvas/crashtests/421715-1.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <script type="text/javascript">
+ function stringify(a) {
+ if (a)
+ return a.toSource();
+ return ''+a;
+ }
+ var args = [undefined, null, [], {}, 0, "0"];
+ var stringArgs = args.map(stringify);
+
+ function test_method(context, method, arity) {
+ function testParams(existingParams, depth) {
+ for (var arg of stringArgs) {
+ var code = "context[method](" + existingParams + arg + ")";
+ try {
+ eval(code);
+ } catch (ex) {
+ // Exceptions are expected
+ }
+
+ if (depth < arity)
+ testParams(existingParams + arg + ",", depth + 1);
+ }
+ }
+ testParams("", 1);
+ }
+
+ function startTest() {
+ var canvas = document.getElementById("img");
+ var context = canvas.getContext('2d');;
+ test_method(context, "getImageData", 4);
+ test_method(context, "putImageData", 3);
+ }
+ </script>
+ </head>
+ <body onload="startTest()">
+ <canvas id="img">No canvas support.</canvas>
+ </body>
+</html>
diff --git a/dom/canvas/crashtests/553938-1.html b/dom/canvas/crashtests/553938-1.html
new file mode 100644
index 0000000000..97e6b6c8ab
--- /dev/null
+++ b/dom/canvas/crashtests/553938-1.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<html>
+ <head>
+ <meta http-equiv="content-type" content="text/html; charset=UTF-8">
+ <title>ImageData Crash Test</title>
+ </head>
+ <body onload="crash();">
+ <canvas id="c" width="10" height="10"></canvas>
+ <script>
+ function crash() {
+ var canvas = document.getElementById('c');
+ var ctx = canvas.getContext('2d');
+ var imgData = {data: new Array(10*10*4), width: 10, height: 10};
+
+ imgData[0] = 0;
+ ctx.putImageData(imgData, 0, 0);
+ }
+ </script>
+ </body>
+</html>
diff --git a/dom/canvas/crashtests/647480.html b/dom/canvas/crashtests/647480.html
new file mode 100644
index 0000000000..2693207b15
--- /dev/null
+++ b/dom/canvas/crashtests/647480.html
@@ -0,0 +1,102 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var canvas = document.createElementNS("http://www.w3.org/1999/xhtml", "canvas");
+ var ctx = canvas.getContext("2d");
+ document.implementation.createDocument("", "", null).adoptNode(canvas);
+
+ try { ctx.save(); } catch(e){}
+ try { ctx.restore(); } catch(e){}
+ try { ctx.scale(0,0); } catch(e){}
+ try { ctx.rotate(90); } catch(e){}
+ try { ctx.translate(1,1); } catch(e){}
+ try { ctx.transform(0,100,200,300,10,10); } catch(e){}
+ try { ctx.setTransform(0,100,200,300,10,10); } catch(e){}
+
+ try { x = ctx.globalAlpha; } catch(e){}
+ try { ctx.globalAlpha = 0.8; } catch(e){}
+ try { x = ctx.globalCompositeOperation; } catch(e){}
+ try { ctx.globalCompositeOperation = "copy"; } catch(e){}
+ try { x = ctx.strokeStyle; } catch(e){}
+ try { ctx.strokeStyle = "red"; } catch(e){}
+ try { x = ctx.fillStyle; } catch(e){}
+ try { ctx.fillStyle = "red"; } catch(e){}
+
+ try { ctx.createLinearGradient(0,100,100,100); } catch(e){}
+ try { ctx.createRadialGradient(0,100,100,100,10,10); } catch(e){}
+ try { ctx.createPattern(document.getElementsByTagName('img')[0], "repeat"); } catch(e){}
+
+ try { x = ctx.lineWidth; } catch(e){}
+ try { ctx.lineWidth = 2; } catch(e){}
+ try { x = ctx.lineCap; } catch(e){}
+ try { ctx.lineCap = "round"; } catch(e){}
+ try { x = ctx.lineJoin; } catch(e){}
+ try { ctx.lineJoin = "bevel"; } catch(e){}
+ try { x = ctx.miterLimit; } catch(e){}
+ try { ctx.miterLimit = 12; } catch(e){}
+
+ try { x = ctx.shadowOffsetX; } catch(e){}
+ try { ctx.shadowOffsetX = 1; } catch(e){}
+ try { x = ctx.shadowOffsetY; } catch(e){}
+ try { ctx.shadowOffsetY = 1; } catch(e){}
+ try { x = ctx.shadowBlur; } catch(e){}
+ try { ctx.shadowBlur = 1; } catch(e){}
+ try { x = ctx.shadowColor; } catch(e){}
+ try { ctx.shadowColor = "red"; } catch(e){}
+
+ try { ctx.clearRect(0,0,100,100); } catch(e){}
+ try { ctx.fillRect(0,0,100,100); } catch(e){}
+ try { ctx.strokeRect(0,0,100,100); } catch(e){}
+
+ try { ctx.beginPath(); } catch(e){}
+ try { ctx.moveTo(1,1); } catch(e){}
+ try { ctx.lineTo(10,10); } catch(e){}
+ try { ctx.quadraticCurveTo(1,2,3,4); } catch(e){}
+ try { ctx.bezierCurveTo(1,2,3,4,5,6); } catch(e){}
+ try { ctx.arcTo(1,2,3,4,5); } catch(e){}
+ try { ctx.arc(1,2,3,4,5); } catch(e){}
+ try { ctx.arc(1,2,3,4,5,true); } catch(e){}
+ try { ctx.rect(1,2,3,4); } catch(e){}
+ try { ctx.closePath(); } catch(e){}
+
+ try { ctx.fill(); } catch(e){}
+ try { ctx.stroke(); } catch(e){}
+ try { ctx.clip(); } catch(e){}
+
+ try { x = ctx.font; } catch(e){}
+ try { ctx.font = "14px sans-serif"; } catch(e){}
+ try { x = ctx.textAlign; } catch(e){}
+ try { ctx.textAlign = "right"; } catch(e){}
+ try { x = ctx.textBaseline; } catch(e){}
+ try { ctx.textBaseline = "top"; } catch(e){}
+
+ try { ctx.fillText("",0,0); } catch(e){}
+ try { ctx.strokeText("",0,0); } catch(e){}
+ try { ctx.measureText(""); } catch(e){}
+
+ try { ctx.mozDrawText(""); } catch(e){}
+ try { ctx.mozPathText(""); } catch(e){}
+ try { ctx.mozTextAlongPath("",true); } catch(e){}
+ try { ctx.mozTextAlongPath("",false); } catch(e){}
+
+ try { ctx.drawImage(document.getElementsByTagName('img')[0], 0, 0); } catch(e){}
+ try { ctx.isPointInPath(0, 0); } catch(e){}
+ try { ctx.createImageData(); } catch(e){}
+ try { ctx.getImageData(); } catch(e){}
+ try { ctx.putImageData(); } catch(e){}
+
+ try { x = ctx.imageSmoothingEnabled; } catch(e){}
+ try { ctx.imageSmoothingEnabled = false; } catch(e){}
+ try { ctx.imageSmoothingEnabled = true; } catch(e){}
+
+ try { ctx.drawWindow(window, 0, 0, 0, 0, "red"); } catch(e){}
+}
+
+</script>
+</head>
+<body onload="boom();"><img width="100" height="100" src="data:image/gif;base64,R0lGODlhAQABAIABAAD/AP///ywAAAAAAQABAAACAkQBADs="></body>
+</html>
diff --git a/dom/canvas/crashtests/727547.html b/dom/canvas/crashtests/727547.html
new file mode 100644
index 0000000000..005841de8a
--- /dev/null
+++ b/dom/canvas/crashtests/727547.html
@@ -0,0 +1,7 @@
+<!doctype html>
+<canvas></canvas>
+<script>
+var canvas = document.body.firstChild,
+ gl = canvas.getContext("experimental-webgl");
+gl.texImage2D(0, 0, 0, 0, 0, { width: 10, height: 10, data: 7 });
+</script>
diff --git a/dom/canvas/crashtests/729116.html b/dom/canvas/crashtests/729116.html
new file mode 100644
index 0000000000..679f9d2965
--- /dev/null
+++ b/dom/canvas/crashtests/729116.html
@@ -0,0 +1,18 @@
+<html>
+<script language=javascript>
+
+function draw() {
+ var canv = document.getElementById("canv");
+ var ctx = canv.getContext("2d");
+ try {
+ canv.width = 50000;
+ } catch (e) { }
+
+ ctx.clearRect(0, 0, 10, 10);
+}
+
+</script>
+<body onload="draw()">
+<canvas id="canv" width="5" height="5"></canvas>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/743499-negative-size.html b/dom/canvas/crashtests/743499-negative-size.html
new file mode 100644
index 0000000000..7cfcd55b2a
--- /dev/null
+++ b/dom/canvas/crashtests/743499-negative-size.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+ <title></title>
+ <script type="text/javascript">
+ function go() {
+ var canvas = document.createElement("canvas");
+ var ctx = canvas.getContext('2d');
+ ctx.globalAlpha = 4
+ ctx.lineCap = "foo"
+ ctx.strokeRect(256,1024,8,4)
+ ctx.shadowColor = "black"
+ ctx.shadowOffsetY = 64
+ ctx.stroke()
+ ctx.moveTo(32,1024)
+ ctx.closePath()
+ }
+ </script>
+</head>
+<body onload="go()">
+<canvas id="canvas"></canvas>
+</body>
+</html> \ No newline at end of file
diff --git a/dom/canvas/crashtests/745699-1.html b/dom/canvas/crashtests/745699-1.html
new file mode 100644
index 0000000000..c65acf201a
--- /dev/null
+++ b/dom/canvas/crashtests/745699-1.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+@font-face {
+ font-family: "z";
+ src: url(invalid);
+}
+</style>
+
+<script>
+function boom()
+{
+ var ctx = document.querySelector("canvas").getContext('2d');
+ ctx.font = "10px serif";
+ document.querySelector("style").appendChild(document.createTextNode(" "));
+ ctx.measureText("123");
+}
+</script>
+</head>
+
+<body onload="boom();">
+<canvas width="100" height="100"></canvas>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/745818-large-source.html b/dom/canvas/crashtests/745818-large-source.html
new file mode 100644
index 0000000000..a5be76be06
--- /dev/null
+++ b/dom/canvas/crashtests/745818-large-source.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var a = document.getElementById("a");
+ var b = document.getElementById("b");
+ a.getContext('2d').createPattern(b, 'no-repeat');
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<canvas id="a" width="61" height="26"></canvas>
+<canvas id="b" width="611" height="439807"></canvas>
+</body>
+
+</html>
diff --git a/dom/canvas/crashtests/746813-1.html b/dom/canvas/crashtests/746813-1.html
new file mode 100644
index 0000000000..0e22e7f9d8
--- /dev/null
+++ b/dom/canvas/crashtests/746813-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.getElementById('c').getContext('2d').getTransform().invertSelf();">
+<canvas id="c" width="772" height="76441"></canvas>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/767337-1.html b/dom/canvas/crashtests/767337-1.html
new file mode 100644
index 0000000000..3c2c4ebd18
--- /dev/null
+++ b/dom/canvas/crashtests/767337-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<body>
+<canvas id="c" width="500" height="1000">
+</canvas>
+<script>
+var ctxt = document.getElementById('c').getContext('2d');
+for (var k = 0; k < 100; ++j) {
+ for (var j = 0; j < 10; ++j) {
+ for (var i = 0; i < 1000; ++i) {
+ gradient = ctxt.createLinearGradient(0,0,200,i);
+ gradient.addColorStop(0,'black');
+ gradient.addColorStop(1,'rgba(0, 255*k/100, 0, 0.1)');
+ ctxt.fillStyle = gradient;
+ ctxt.fillRect(j*50, 2*i, 50, 2);
+ }
+ }
+}
+</script>
+</body>
+</html> \ No newline at end of file
diff --git a/dom/canvas/crashtests/779426.html b/dom/canvas/crashtests/779426.html
new file mode 100644
index 0000000000..ded3455b81
--- /dev/null
+++ b/dom/canvas/crashtests/779426.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var canvas = document.createElementNS('http://www.w3.org/1999/xhtml', 'canvas');
+ var canvas2d = canvas.getContext('2d');
+ canvas2d.rect(0, 0, 1, 1);
+ canvas2d.transform(1, 0, 0, 1, 0, 0);
+ canvas.setAttributeNS(null, "height", "99");
+ canvas2d.rect(0, 0, 1, 1);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/780392-1.html b/dom/canvas/crashtests/780392-1.html
new file mode 100644
index 0000000000..2112c9a759
--- /dev/null
+++ b/dom/canvas/crashtests/780392-1.html
@@ -0,0 +1,10 @@
+<!doctype HTML>
+<html>
+<body>
+<canvas id="c" width="10000" height="10000"></canvas>
+<script>
+var ctx = document.getElementById("c").getContext("2d");
+ctx.fillText("Hello world!", 50, 50);
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/789933-1.html b/dom/canvas/crashtests/789933-1.html
new file mode 100644
index 0000000000..a5f2f3437b
--- /dev/null
+++ b/dom/canvas/crashtests/789933-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<body>
+<canvas id="c" width="5000" height="20000">
+</canvas>
+<script>
+var ctxt = document.getElementById('c').getContext('2d');
+ctxt.strokeStyle = "Red";
+ctxt.font = "bold 16px Arial";
+ctxt.strokeText('Hello World!', 100, 100);
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/794463-1.html b/dom/canvas/crashtests/794463-1.html
new file mode 100644
index 0000000000..5726baa743
--- /dev/null
+++ b/dom/canvas/crashtests/794463-1.html
@@ -0,0 +1,17 @@
+<!-- Any copyright is dedicated to the Public Domain.
+ - http://creativecommons.org/publicdomain/zero/1.0/ -->
+
+<!doctype HTML>
+<html>
+<body>
+<canvas id="c" width="100" height="100"></canvas>
+<script>
+var c = document.getElementById("c");
+var ctx = c.getContext("2d");
+var p = ctx.createPattern(c, "no-repeat");
+ctx.rect(0, 0, 100, 100);
+ctx.fillStyle = p;
+ctx.fill();
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/802926-1.html b/dom/canvas/crashtests/802926-1.html
new file mode 100644
index 0000000000..a42ca50c1b
--- /dev/null
+++ b/dom/canvas/crashtests/802926-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<script>
+
+document.createElement('canvas').toBlob(null);
+
+</script>
diff --git a/dom/canvas/crashtests/844280.html b/dom/canvas/crashtests/844280.html
new file mode 100644
index 0000000000..5d1e2dceab
--- /dev/null
+++ b/dom/canvas/crashtests/844280.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var canvas = document.createElement("canvas");
+ canvas.setAttribute("width", "7623");
+ canvas.setAttribute("height", "14064");
+ canvas.getContext("experimental-webgl");
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/896047-1.html b/dom/canvas/crashtests/896047-1.html
new file mode 100644
index 0000000000..2b121b2279
--- /dev/null
+++ b/dom/canvas/crashtests/896047-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<body>
+<canvas id="c" width="200" height="100">
+</canvas>
+<script>
+var ctx = document.getElementById("c").getContext("2d");
+ctx.save();
+ctx.save();
+ctx.rect(0,0, 1,1);
+ctx.restore();
+ctx.fill('evenodd');
+ctx.restore();
+ctx.lineTo(10, 0);
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/896047-2.html b/dom/canvas/crashtests/896047-2.html
new file mode 100644
index 0000000000..4cd12dfb48
--- /dev/null
+++ b/dom/canvas/crashtests/896047-2.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<body>
+<canvas id="c" width="200" height="100">
+</canvas>
+<script>
+var ctx = document.getElementById("c").getContext("2d");
+ctx.save();
+ctx.mozFillRule = 'nonzero';
+ctx.save();
+ctx.mozFillRule = 'evenodd';
+ctx.rect(0,0, 1,1);
+ctx.restore();
+ctx.isPointInPath(0,0);
+ctx.restore();
+ctx.lineTo(10, 0);
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/916128-1.html b/dom/canvas/crashtests/916128-1.html
new file mode 100644
index 0000000000..7981271e9c
--- /dev/null
+++ b/dom/canvas/crashtests/916128-1.html
@@ -0,0 +1,13 @@
+<script>
+o0 = document.createElement('canvas');
+(document.body || document.documentElement).appendChild(o0);
+o1 = o0.getContext('2d');
+o2 = document.createElement('img');
+//o2.src = "image2.png";
+o3 = o1.createImageData(0.7409945472006207, 0.8815588599260801);
+o1.save();
+o1.setTransform(0.18777365986904448, 4, 4, -2048, 3, 32);
+o0.width = 0.52;
+o1.putImageData(o3, -32, -0.16596290333335356);
+o0.toBlob(function() {}, "video/mp4", 16);
+</script>
diff --git a/dom/canvas/crashtests/934939-1.html b/dom/canvas/crashtests/934939-1.html
new file mode 100644
index 0000000000..d2ffbf4755
--- /dev/null
+++ b/dom/canvas/crashtests/934939-1.html
@@ -0,0 +1,8 @@
+<script type="text/javascript">
+ function run() {
+ var cx = canvas.getContext("2d");
+ canvas.toDataURL("image/png");
+ }
+</script>
+<body onload="run()">
+<canvas width="1" height="65536" id="canvas"></canvas>
diff --git a/dom/canvas/crashtests/989628.html b/dom/canvas/crashtests/989628.html
new file mode 100644
index 0000000000..99735a947a
--- /dev/null
+++ b/dom/canvas/crashtests/989628.html
@@ -0,0 +1,9 @@
+<script>
+o0 = document.createElement('canvas');
+o1 = o0.getContext('2d');
+o3 = o1.createImageData(32, 0.696);
+o1.arc(128, 0.37, 256, 4, 0.070, true);
+o1.moveTo(-2, 0.973);
+o1.clip('evenodd');
+o1.strokeText("A",0.610,-0.335,0.817);
+</script>
diff --git a/dom/canvas/crashtests/crashtests.list b/dom/canvas/crashtests/crashtests.list
new file mode 100644
index 0000000000..fb15a8d73d
--- /dev/null
+++ b/dom/canvas/crashtests/crashtests.list
@@ -0,0 +1,67 @@
+load 0px-size-font-667225.html
+load 0px-size-font-shadow.html
+load 360293-1.html
+load 421715-1.html
+load 553938-1.html
+load 647480.html
+skip-if(Android&&browserIsRemote) load 727547.html # bug 1507207
+load 729116.html
+load 745699-1.html
+load 746813-1.html
+load 743499-negative-size.html
+load 745818-large-source.html
+load 767337-1.html
+load 779426.html
+skip-if(ThreadSanitizer) load 780392-1.html
+skip-if(ThreadSanitizer) skip-if(gtkWidget&&isDebugBuild) skip-if(winWidget&&(!is64Bit)) load 789933-1.html # bug 1155252 for linux
+skip-if(ThreadSanitizer) load 794463-1.html
+skip-if(ThreadSanitizer) load 802926-1.html
+skip-if(ThreadSanitizer) skip-if(winWidget&&isDebugBuild&&/^Windows\x20NT\x206\.1/.test(http.oscpu)) load 844280.html # intermittent OOMs on Win7 debug
+load 896047-1.html
+load 916128-1.html
+load 934939-1.html
+load 989628.html
+load 1099143-1.html
+load 1161277-1.html
+load 1183363.html
+load 1190705.html
+load 1223740-1.html
+load 1225381-1.html
+skip-if(azureCairo) load 1229983-1.html
+load 1229932-1.html
+load 1244850-1.html
+load 1246775-1.html
+load 1284356-1.html
+load 1284578-1.html
+skip-if(d2d) load 1287515-1.html
+load 1287652-1.html
+load 1288872-1.html
+load 1290628-1.html
+load 1283113-1.html
+load 1286458-1.html
+load 1296410-1.html
+load 1298576-1.html
+load 1299062-1.html
+load 1305085-1.html
+load 1305312-1.html
+load 1305850.html
+load 1334366-1.html
+load 1334647-1.html
+skip-if(geckoview) load 1349067.html # Bug 1563214 for GV+WR
+skip-if(ThreadSanitizer) pref(gfx.offscreencanvas.enabled,true) load 1348976-1.html
+load 1357092.html
+load 1441613.html
+pref(gfx.offscreencanvas.enabled,true) load 1443671.html
+pref(gfx.offscreencanvas.enabled,true) load 1546390.html
+load 1549853.html
+load 1551745.html
+load 1569648.html
+skip-if(!winWidget||!isDebugBuild) pref(layers.gpu-process.crash-also-crashes-browser,true) load 1654477.html
+load 1739454-1.html
+load 1740031.html
+pref(webgl.enable-privileged-extensions,true) load 1744172.html
+load 1757925-1.html
+load 1757755.html
+pref(gfx.offscreencanvas.enabled,true) load 1769878.html
+pref(gfx.offscreencanvas.enabled,true) load 1771007-1.html
+pref(dom.webgpu.enabled,true) load 1816140.html
diff --git a/dom/canvas/crashtests/texImage2D.html b/dom/canvas/crashtests/texImage2D.html
new file mode 100644
index 0000000000..370b008572
--- /dev/null
+++ b/dom/canvas/crashtests/texImage2D.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<canvas></canvas>
+<script>
+var canvas = document.body.firstChild,
+ gl = canvas.getContext("experimental-webgl");
+gl.texImage2D(0, 0, 0, 0, 0, { get width() { throw 7 }, get height() { throw 7 }, data: new Uint8ClampedArray(10) });
+gl.texSubImage2D(0, 0, 0, 0, 0, 0, { get width() { throw 7 }, get height() { throw 7 }, data: new Uint8ClampedArray(10) });
+</script>