9 files changed, 117 insertions, 0 deletions
diff --git a/dom/workers/test/crashtests/1153636.html b/dom/workers/test/crashtests/1153636.html
new file mode 100644
index 0000000000..6ad0d550fd
--- /dev/null
+++ b/dom/workers/test/crashtests/1153636.html
@@ -0,0 +1,5 @@
+<script>
+
+new Worker("data:text/javascript;charset=UTF-8,self.addEventListener('',function(){},false);");
+
+</script>
diff --git a/dom/workers/test/crashtests/1158031.html b/dom/workers/test/crashtests/1158031.html
new file mode 100644
index 0000000000..6d896bc466
--- /dev/null
+++ b/dom/workers/test/crashtests/1158031.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<script>
+
+function boom()
+{
+    var w = new Worker("data:text/javascript;charset=UTF-8,");
+    w.postMessage(new Blob([], {}));
+}
+
+</script>
+<body onload="boom();"></body>
diff --git a/dom/workers/test/crashtests/1228456.html b/dom/workers/test/crashtests/1228456.html
new file mode 100644
index 0000000000..6d1f0f0a72
--- /dev/null
+++ b/dom/workers/test/crashtests/1228456.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<script>
+
+function boom()
+{
+    var w;
+    for (var i = 0; i < 99; ++i) {
+        w = new SharedWorker("data:text/javascript;charset=UTF-8," + encodeURIComponent(i + ";"));
+    }
+    w.port.postMessage("");
+}
+
+</script>
+<body onload="boom();"></body>
diff --git a/dom/workers/test/crashtests/1348882.html b/dom/workers/test/crashtests/1348882.html
new file mode 100644
index 0000000000..e0288c4ccb
--- /dev/null
+++ b/dom/workers/test/crashtests/1348882.html
@@ -0,0 +1,18 @@
+<!DOCTYPE>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+function boom() {
+  let r = new Request("#a#a");
+  setTimeout(function(){
+    r.formData();
+    setTimeout(function(){
+      r.blob();
+    }, 0);
+  }, 0);
+}
+addEventListener("DOMContentLoaded", boom);
+</script>
+</head>
+</html>
diff --git a/dom/workers/test/crashtests/1819146.html b/dom/workers/test/crashtests/1819146.html
new file mode 100644
index 0000000000..611acb3ed2
--- /dev/null
+++ b/dom/workers/test/crashtests/1819146.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <script id="worker1" type="javascript/worker">
+        self.onmessage = async function (e) {
+          const abort = new AbortController()
+          const signal = abort.signal
+          abort.abort()
+          close()
+          try { await fetch(undefined, { signal: signal }) } catch (e) {}
+          await navigator.locks.request("weblock_0", { signal: signal }, () => {})
+          await fetch(undefined, { headers: [] })
+        }
+    </script>
+    <script>
+      document.addEventListener('DOMContentLoaded', () => {
+        const blob = new Blob([document.querySelector('#worker1').textContent], { type: 'text/javascript' })
+        const worker = new Worker(window.URL.createObjectURL(blob))
+        worker.postMessage([], [])
+      })
+    </script>
+</head>
+</html>
diff --git a/dom/workers/test/crashtests/1821066.html b/dom/workers/test/crashtests/1821066.html
new file mode 100644
index 0000000000..d654b37768
--- /dev/null
+++ b/dom/workers/test/crashtests/1821066.html
@@ -0,0 +1,9 @@
+<!DOCTYPE>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+new Worker("data:text/javascript;charset=UTF-8,import { o } from '404.js'", {type: 'module'});
+</script>
+</head>
+</html>
diff --git a/dom/workers/test/crashtests/779707.html b/dom/workers/test/crashtests/779707.html
new file mode 100644
index 0000000000..97a8113dab
--- /dev/null
+++ b/dom/workers/test/crashtests/779707.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var x = new XMLHttpRequest();
+  x.open('GET', "data:text/plain,2", false);
+  x.send();
+
+  new Worker("data:text/javascript,3");
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/workers/test/crashtests/943516.html b/dom/workers/test/crashtests/943516.html
new file mode 100644
index 0000000000..5f4667850f
--- /dev/null
+++ b/dom/workers/test/crashtests/943516.html
@@ -0,0 +1,10 @@
+<!--
+Any copyright is dedicated to the Public Domain.
+http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE html>
+<script>
+// Using a DOM bindings object as a weak map key should not crash when attempting to
+// call the preserve wrapper callback.
+new Worker("data:text/javascript;charset=UTF-8,(new WeakMap()).set(self, 0);")
+</script>
diff --git a/dom/workers/test/crashtests/crashtests.list b/dom/workers/test/crashtests/crashtests.list
new file mode 100644
index 0000000000..528f4c8a10
--- /dev/null
+++ b/dom/workers/test/crashtests/crashtests.list
@@ -0,0 +1,8 @@
+load 779707.html
+load 943516.html
+load 1153636.html
+load 1158031.html
+load 1228456.html
+load 1348882.html
+load 1821066.html
+load 1819146.html