summaryrefslogtreecommitdiffstats
path: root/image/test/crashtests
diff options
context:
space:
mode:
Diffstat (limited to 'image/test/crashtests')
-rw-r--r--image/test/crashtests/1205923-1.html36
-rw-r--r--image/test/crashtests/1210745-1.gifbin0 -> 23 bytes
-rw-r--r--image/test/crashtests/1212954-1.svg16
-rw-r--r--image/test/crashtests/1235605.gifbin0 -> 2360 bytes
-rw-r--r--image/test/crashtests/1241728-1.html17
-rw-r--r--image/test/crashtests/1241729-1.bmpbin0 -> 548 bytes
-rw-r--r--image/test/crashtests/1241729-1.html5
-rw-r--r--image/test/crashtests/1242093-1.html22
-rw-r--r--image/test/crashtests/1242778-1.pngbin0 -> 15929 bytes
-rw-r--r--image/test/crashtests/1249576-1.pngbin0 -> 1169 bytes
-rw-r--r--image/test/crashtests/1251091-1.html51
-rw-r--r--image/test/crashtests/1251091-1.pngbin0 -> 95370 bytes
-rw-r--r--image/test/crashtests/1253362-1.html11
-rw-r--r--image/test/crashtests/1262549-1.gifbin0 -> 428 bytes
-rw-r--r--image/test/crashtests/1277397-1.jpgbin0 -> 266 bytes
-rw-r--r--image/test/crashtests/1277397-2.jpgbin0 -> 1407 bytes
-rw-r--r--image/test/crashtests/1355898-1.html45
-rw-r--r--image/test/crashtests/1375842-1.html16
-rw-r--r--image/test/crashtests/1413762-1.gifbin0 -> 7866 bytes
-rw-r--r--image/test/crashtests/1443232-1.gifbin0 -> 42434 bytes
-rw-r--r--image/test/crashtests/1443232-1.html30
-rw-r--r--image/test/crashtests/1509998.gifbin0 -> 92 bytes
-rw-r--r--image/test/crashtests/1526717-1.html1
-rw-r--r--image/test/crashtests/1526717-1.pngbin0 -> 318 bytes
-rw-r--r--image/test/crashtests/1629490-1-iframe.html1
-rw-r--r--image/test/crashtests/1629490-1.html49
-rw-r--r--image/test/crashtests/1634839-1-iframe.html1
-rw-r--r--image/test/crashtests/1634839-1.html51
-rw-r--r--image/test/crashtests/1634839-2-iframe.html1
-rw-r--r--image/test/crashtests/1634839-2.html51
-rw-r--r--image/test/crashtests/1676172-1-iframe.html13
-rw-r--r--image/test/crashtests/1676172-1.gifbin0 -> 2439 bytes
-rw-r--r--image/test/crashtests/1676172-1.html57
-rw-r--r--image/test/crashtests/1763581-1-iframe.html15
-rw-r--r--image/test/crashtests/1763581-1.gifbin0 -> 70793 bytes
-rw-r--r--image/test/crashtests/1763581-1.html28
-rw-r--r--image/test/crashtests/1763581-1.sjs71
-rw-r--r--image/test/crashtests/1765871-1.jpgbin0 -> 6872 bytes
-rw-r--r--image/test/crashtests/1814553.avifbin0 -> 803330 bytes
-rw-r--r--image/test/crashtests/1814561.avifbin0 -> 2104 bytes
-rw-r--r--image/test/crashtests/1814677.avifbin0 -> 1607 bytes
-rw-r--r--image/test/crashtests/1814708.avifbin0 -> 1607 bytes
-rw-r--r--image/test/crashtests/1814741.avifbin0 -> 1607 bytes
-rw-r--r--image/test/crashtests/1814774.avifbin0 -> 2104 bytes
-rw-r--r--image/test/crashtests/1817108.avifbin0 -> 2105 bytes
-rw-r--r--image/test/crashtests/256-height.icobin0 -> 154 bytes
-rw-r--r--image/test/crashtests/256-width.icobin0 -> 154 bytes
-rw-r--r--image/test/crashtests/463696.bmpbin0 -> 1272 bytes
-rw-r--r--image/test/crashtests/523528-1.gifbin0 -> 132 bytes
-rw-r--r--image/test/crashtests/523528-2.gifbin0 -> 132 bytes
-rw-r--r--image/test/crashtests/570451.pngbin0 -> 114 bytes
-rw-r--r--image/test/crashtests/694165-1.xhtml510
-rw-r--r--image/test/crashtests/732319-1.html2
-rw-r--r--image/test/crashtests/83804-1.gifbin0 -> 37 bytes
-rw-r--r--image/test/crashtests/844403-1.html10
-rw-r--r--image/test/crashtests/856616.gifbin0 -> 27 bytes
-rw-r--r--image/test/crashtests/89341-1.gifbin0 -> 769 bytes
-rw-r--r--image/test/crashtests/944353.jpgbin0 -> 610965 bytes
-rw-r--r--image/test/crashtests/colormap-range.gifbin0 -> 5657 bytes
-rw-r--r--image/test/crashtests/crashtests.list84
-rw-r--r--image/test/crashtests/delayedframe.sjs44
-rw-r--r--image/test/crashtests/delaytest.html59
-rw-r--r--image/test/crashtests/discardframe.htm1
-rw-r--r--image/test/crashtests/finite-apng.pngbin0 -> 5834 bytes
-rw-r--r--image/test/crashtests/ie.pngbin0 -> 466589 bytes
-rw-r--r--image/test/crashtests/invalid-disposal-method-1.gifbin0 -> 167 bytes
-rw-r--r--image/test/crashtests/invalid-disposal-method-2.gifbin0 -> 167 bytes
-rw-r--r--image/test/crashtests/invalid-disposal-method-3.gifbin0 -> 167 bytes
-rw-r--r--image/test/crashtests/invalid-icc-profile.jpgbin0 -> 2568 bytes
-rw-r--r--image/test/crashtests/invalid-size-second-frame.gifbin0 -> 673 bytes
-rw-r--r--image/test/crashtests/invalid-size.gifbin0 -> 329 bytes
-rw-r--r--image/test/crashtests/invalid_ico_height.icobin0 -> 894 bytes
-rw-r--r--image/test/crashtests/invalid_ico_width.icobin0 -> 894 bytes
-rw-r--r--image/test/crashtests/multiple-png-hassize.icobin0 -> 18096 bytes
-rw-r--r--image/test/crashtests/out2.gifbin0 -> 24129 bytes
-rw-r--r--image/test/crashtests/ownerdiscard.html48
-rw-r--r--image/test/crashtests/rainbow.gifbin0 -> 6171 bytes
-rw-r--r--image/test/crashtests/threeframes-end.gifbin0 -> 16 bytes
-rw-r--r--image/test/crashtests/threeframes-start.gifbin0 -> 92 bytes
-rw-r--r--image/test/crashtests/truncated-second-frame.pngbin0 -> 72247 bytes
-rw-r--r--image/test/crashtests/unsized-svg.svg1
81 files changed, 1347 insertions, 0 deletions
diff --git a/image/test/crashtests/1205923-1.html b/image/test/crashtests/1205923-1.html
new file mode 100644
index 0000000000..456fc51b6e
--- /dev/null
+++ b/image/test/crashtests/1205923-1.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<body>
+</body>
+<script>
+ function createImage(loadHandler) {
+ var newImage = new Image;
+ newImage.id = "thepreviewimage";
+ newImage.setAttribute("src", "unsized-svg.svg");
+ if (loadHandler) {
+ newImage.onload = loadHandler;
+ }
+
+ // Query width & height, and display them in document:
+ physWidth = newImage.width;
+ physHeight = newImage.height;
+ document.documentElement.innerHTML +=
+ physWidth + " x " + physHeight + "<br>";
+ }
+
+ function part2() {
+ // Load image again:
+ createImage();
+
+ // End the crashtest.
+ document.documentElement.removeAttribute("class");
+ }
+
+ function startTest() {
+ // Trigger image load, and call part2() when it's loaded:
+ createImage(part2);
+ }
+
+ startTest();
+</script>
+</html>
diff --git a/image/test/crashtests/1210745-1.gif b/image/test/crashtests/1210745-1.gif
new file mode 100644
index 0000000000..92bcf72224
--- /dev/null
+++ b/image/test/crashtests/1210745-1.gif
Binary files differ
diff --git a/image/test/crashtests/1212954-1.svg b/image/test/crashtests/1212954-1.svg
new file mode 100644
index 0000000000..83dd7b9c7f
--- /dev/null
+++ b/image/test/crashtests/1212954-1.svg
@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:xlink="http://www.w3.org/1999/xlink">
+
+ <defs>
+ <filter id="f">
+ <!-- the image data is
+ <svg xmlns="http://www.w3.org/2000/svg" width="-5" height="1%" />
+ -->
+ <feImage xlink:href="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSItNSIgaGVpZ2h0
+PSIxJSIgLz4K" />
+ </filter>
+ </defs>
+
+ <rect width="1" height="1" filter="url(#f)" />
+
+</svg>
diff --git a/image/test/crashtests/1235605.gif b/image/test/crashtests/1235605.gif
new file mode 100644
index 0000000000..e7c3ea0b87
--- /dev/null
+++ b/image/test/crashtests/1235605.gif
Binary files differ
diff --git a/image/test/crashtests/1241728-1.html b/image/test/crashtests/1241728-1.html
new file mode 100644
index 0000000000..126c02e624
--- /dev/null
+++ b/image/test/crashtests/1241728-1.html
@@ -0,0 +1,17 @@
+<html>
+<body>
+<img id='m1' src='data:image/bmp;base64,Qk16AAAAAAAAAJUAABMoAAAAIA4AACAAACYBAAQAAgAAAAB/AAQCAADE9Sj/AAkAAAAAAAAR4AAAAAD/AAAA//8A////AAAAAAAAAAAAAAAAADAAMzMzMzMzMDMzMwMzGAMzMzMzMzMwABEIAf8AAAAzMzMzMzMwADIzMxERERMzMxERERGAADMzMwAAAIAzMzMzMzMzPzMzMwAAADAAADNGMzMzM0JNegAAAAAAABN2AAAAKAAAACAOAAAgFgAAAQAEAAIAAAAAfxYAEgsAABILAAAAABp/VLge/AAA/+D6AAAAAP8AAP//AP///wAAAAAwAAMzMzMzIgOPMzMzOxCA/42NjY2NjY2NjY0zM0EcMzLgMzAzMzMzMzMzMzMzMzMfAAAREREz/xE2MzczMzwWMzMAAACAMzMzLzMzMz8zMzMAAAAwAAAzRkZGRkYzMzAzMwkDMzMwSjMzMxEzMzMwABERAR4EADPyMzMzMzMwFhYWLQAAAIAzERYGFhYWFhYWVhYWFhYWFhYWFhYWFhYWFhYWFhsWAxYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYzM0EcMzLgMzAzMzMWFhYWFhYW//8AAAMWFhYWFhYWFhEZEREDMzMzMzMzMzMwfzMzM1AzMAMzMzQgAAAAEQMzMzMwFwAIAIMzMzMeYRAcMzLgMzAzMzMzAzL4MzMzMzPoAzMzMzMv+i/uMzMzMzM='>
+<img id='m2' height='2' width='2'>
+<canvas id='c1'></canvas>
+<script>
+ var im1=document.getElementById('m1');
+ var im2=document.getElementById('m2');
+ im2.src=im1.src;
+ window.onload=function(){
+ var ctx=document.getElementById('c1').getContext('2d');
+ ctx.drawImage(im1, 0, 0);
+ ctx.drawImage(im2, 0, 0);
+ }
+</script>
+</body>
+</html> \ No newline at end of file
diff --git a/image/test/crashtests/1241729-1.bmp b/image/test/crashtests/1241729-1.bmp
new file mode 100644
index 0000000000..e6f36d0398
--- /dev/null
+++ b/image/test/crashtests/1241729-1.bmp
Binary files differ
diff --git a/image/test/crashtests/1241729-1.html b/image/test/crashtests/1241729-1.html
new file mode 100644
index 0000000000..47f23134b4
--- /dev/null
+++ b/image/test/crashtests/1241729-1.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+<img src="1241729-1.bmp" style="width: 10px; height: 10px;">
+</body>
+</html>
diff --git a/image/test/crashtests/1242093-1.html b/image/test/crashtests/1242093-1.html
new file mode 100644
index 0000000000..3eab166efd
--- /dev/null
+++ b/image/test/crashtests/1242093-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset='UTF-8'>
+<meta http-equiv='Cache-control' content='no-cache'>
+</head>
+<body>
+<img id='m1' src='data:image/bmp;base64,Qk1mDgAAAAAAAHYAAAAoAAAAQAEAAPAAAAABAAQAAgAAAPANAADoAwAA6AMAABAAAAAAAAAA/wD/AAAAAAAAAP8AAP8AAP8AAAD///8AzMzMAMzMzADMzMwAzMzMAMzMzADMzMwAzMzMAMzMzADMzMwAzMzMAAACAAEAAgABAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAAAAAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRCAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBpRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAIAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICADgRMCIAAmoAakQAAAACAgA4ETAiAAJqAGpEAAAAAgIABhEBVQURA1UDEQFVCREEVQIRBFUCEQFVCBEBVQYRMCIAAmoAakQAAAACAgAGEQFVBBEBVQMRAVUCEQFVCREBVQURAVUFEQFVCBEBVQYRMCIAAmoAakQAAAACAgAGEQFVBBEBVQMRAVUCEQFVCREBVQURAVUFEQFVCBEBVQYRMCIAAmoAakQAAAACAgAGEQFVBBEBVQMRAVUCEQRVBhEBVQURA1UDEQNVBhEBVQYRMCIAAmoAakQAAAACAgAGEQFVBBEBVQMRAVUCEQFVAxEBVQURAVUFEQFVBREBVQgRAVUGETAiAAJqAGpEAAAAAgIABhEBVQQRAVUDEQFVAhEBVQMRAVUFEQFVBREBVQURAVUIEQFVBhEwIgACagBqRAAAAAICAAMRB1UCEQNVAxEEVQYRAVUFEQRVAhEEVQIRB1UDETAiAAJqAGpEAAAAAgIAOBEwIgACagBqRAAAAAICADgRMCIAAmoAakQAAAACAAEAAgABAAE='>
+<img id='m2' height='2' width='2'>
+<canvas id='c1'></canvas>
+<script>
+ var im1=document.getElementById('m1');
+ var im2=document.getElementById('m2');
+ im2.src=im1.src;
+ window.onload=function(){
+ var ctx=document.getElementById('c1').getContext('2d');
+ ctx.drawImage(im1, 0, 0); // sync docoder call
+ ctx.drawImage(im2, 0, 0); // sync downscaler call
+ }
+</script>
+</body>
+</html> \ No newline at end of file
diff --git a/image/test/crashtests/1242778-1.png b/image/test/crashtests/1242778-1.png
new file mode 100644
index 0000000000..4504d54e45
--- /dev/null
+++ b/image/test/crashtests/1242778-1.png
Binary files differ
diff --git a/image/test/crashtests/1249576-1.png b/image/test/crashtests/1249576-1.png
new file mode 100644
index 0000000000..637dafbc2b
--- /dev/null
+++ b/image/test/crashtests/1249576-1.png
Binary files differ
diff --git a/image/test/crashtests/1251091-1.html b/image/test/crashtests/1251091-1.html
new file mode 100644
index 0000000000..520a393b43
--- /dev/null
+++ b/image/test/crashtests/1251091-1.html
@@ -0,0 +1,51 @@
+<!doctype html>
+<html class="reftest-wait">
+ <head>
+ <script type="text/javascript">
+var gl;
+
+function start() {
+ var canvas = document.getElementById("glcanvas");
+ gl = canvas.getContext("webgl") || canvas.getContext("experimental-webgl");
+
+ if (gl) {
+ initTextures();
+ } else {
+ finish();
+ }
+}
+
+function initTextures() {
+ var cubeTexture = gl.createTexture();
+ var cubeImage = document.getElementById("i");
+ cubeImage.onload = function() { handleTextureLoaded(cubeImage, cubeTexture); }
+ cubeImage.onerror = function() { finish(); }
+ cubeImage.src = "1251091-1.png";
+}
+
+function handleTextureLoaded(image, texture) {
+ gl.bindTexture(gl.TEXTURE_2D, texture);
+ gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, gl.RGBA, gl.UNSIGNED_BYTE, image);
+ gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MAG_FILTER, gl.LINEAR);
+ gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MIN_FILTER, gl.LINEAR_MIPMAP_NEAREST);
+ gl.generateMipmap(gl.TEXTURE_2D);
+ gl.bindTexture(gl.TEXTURE_2D, null);
+ setTimeout(showit,0);
+}
+
+function showit() {
+ document.getElementById("i").style.display = "";
+ finish();
+}
+
+function finish() {
+ document.documentElement.removeAttribute("class");
+}
+ </script>
+ </head>
+
+ <body onload="start()">
+ <canvas id="glcanvas" width="640" height="480"></canvas>
+ <img id="i" style="display: none;">
+ </body>
+</html> \ No newline at end of file
diff --git a/image/test/crashtests/1251091-1.png b/image/test/crashtests/1251091-1.png
new file mode 100644
index 0000000000..078b19a569
--- /dev/null
+++ b/image/test/crashtests/1251091-1.png
Binary files differ
diff --git a/image/test/crashtests/1253362-1.html b/image/test/crashtests/1253362-1.html
new file mode 100644
index 0000000000..fdee850aab
--- /dev/null
+++ b/image/test/crashtests/1253362-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body>
+
+<div style="content: url(data:image/svg+xml;charset=utf-8,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20style%3D%22background%3A%20url%28data%3Aimage%2Fsvg%2Bxml%2C%253Csvg%2520xmlns%253D%2522http%253A%252F%252Fwww.w3.org%252F2000%252Fsvg%2522%253E%253C%252Fsvg%253E%29%22%3E%3C%2Fsvg%3E%0D%0A)"></div>
+
+</body>
+</html>
diff --git a/image/test/crashtests/1262549-1.gif b/image/test/crashtests/1262549-1.gif
new file mode 100644
index 0000000000..7cb2e769d2
--- /dev/null
+++ b/image/test/crashtests/1262549-1.gif
Binary files differ
diff --git a/image/test/crashtests/1277397-1.jpg b/image/test/crashtests/1277397-1.jpg
new file mode 100644
index 0000000000..54f21182b6
--- /dev/null
+++ b/image/test/crashtests/1277397-1.jpg
Binary files differ
diff --git a/image/test/crashtests/1277397-2.jpg b/image/test/crashtests/1277397-2.jpg
new file mode 100644
index 0000000000..f9fc8744e8
--- /dev/null
+++ b/image/test/crashtests/1277397-2.jpg
Binary files differ
diff --git a/image/test/crashtests/1355898-1.html b/image/test/crashtests/1355898-1.html
new file mode 100644
index 0000000000..2df55b34ac
--- /dev/null
+++ b/image/test/crashtests/1355898-1.html
@@ -0,0 +1,45 @@
+<!doctype html>
+<html>
+ <head>
+ <script>
+// Test that texImage2D on an animated image doesn't assert.
+
+var gl;
+
+function start() {
+ canvas = document.getElementById("glcanvas");
+ gl = null;
+
+ try {
+ gl = canvas.getContext("webgl") || canvas.getContext("experimental-webgl");
+ }
+ catch(e) {
+ }
+
+ if (!gl) {
+ return;
+ }
+
+ var texture = gl.createTexture();
+ var image = new Image();
+ image.onload = function() { handleTextureLoaded(image, texture); }
+ image.src = "1249576-1.png"; // an animated png
+}
+
+function handleTextureLoaded(image, texture) {
+ gl.bindTexture(gl.TEXTURE_2D, texture);
+ gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, gl.RGBA, gl.UNSIGNED_BYTE, image);
+ gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MAG_FILTER, gl.LINEAR);
+ gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MIN_FILTER, gl.LINEAR_MIPMAP_NEAREST);
+ gl.generateMipmap(gl.TEXTURE_2D);
+ gl.bindTexture(gl.TEXTURE_2D, null);
+}
+ </script>
+ </head>
+
+ <body onload="start()">
+ <canvas id="glcanvas" width="640" height="480">
+ Your browser doesn't appear to support the <code>&lt;canvas&gt;</code> element.
+ </canvas>
+ </body>
+</html> \ No newline at end of file
diff --git a/image/test/crashtests/1375842-1.html b/image/test/crashtests/1375842-1.html
new file mode 100644
index 0000000000..457966a1b9
--- /dev/null
+++ b/image/test/crashtests/1375842-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<style>
+textarea {
+ border: red;
+ transform: rotate(-0.01rad);
+}
+</style>
+</head>
+<body>
+<textarea></textarea>
+</body>
+</html>
+
diff --git a/image/test/crashtests/1413762-1.gif b/image/test/crashtests/1413762-1.gif
new file mode 100644
index 0000000000..5dd10b8f25
--- /dev/null
+++ b/image/test/crashtests/1413762-1.gif
Binary files differ
diff --git a/image/test/crashtests/1443232-1.gif b/image/test/crashtests/1443232-1.gif
new file mode 100644
index 0000000000..198519e7c0
--- /dev/null
+++ b/image/test/crashtests/1443232-1.gif
Binary files differ
diff --git a/image/test/crashtests/1443232-1.html b/image/test/crashtests/1443232-1.html
new file mode 100644
index 0000000000..a7302e9e16
--- /dev/null
+++ b/image/test/crashtests/1443232-1.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<body>
+<img id='m1'><br/>
+<script>
+ var im1=document.getElementById('m1');
+ var step_state=0;
+ function handle_step(){
+ step_state+=1;
+ if(step_state == 1){
+ im1.src='data:image/gif;base64,R0lGODlhAQABAIABAP///wAAACwAAAAAAQABAAACAkQBADs=';
+ }
+ else if(step_state==2){
+ im1.src='1443232-1.gif';
+ }
+ else if(step_state==3){
+ if(im1.height==2)
+ im1.height=1;
+ im1.height=2;
+ im1.getBoundingClientRect();
+ setTimeout(function(){document.documentElement.classList.remove("reftest-wait");}, 1000);
+ }
+ }
+ document.addEventListener('DOMContentLoaded', function(){
+ im1.addEventListener('load', handle_step, false);
+ im1.src='data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==';
+ });
+</script>
+</body>
+</html>
diff --git a/image/test/crashtests/1509998.gif b/image/test/crashtests/1509998.gif
new file mode 100644
index 0000000000..05b141ba5f
--- /dev/null
+++ b/image/test/crashtests/1509998.gif
Binary files differ
diff --git a/image/test/crashtests/1526717-1.html b/image/test/crashtests/1526717-1.html
new file mode 100644
index 0000000000..b120340416
--- /dev/null
+++ b/image/test/crashtests/1526717-1.html
@@ -0,0 +1 @@
+<img height="64" width="64" src="fuzz-1311.png?0.5592939664601271"> \ No newline at end of file
diff --git a/image/test/crashtests/1526717-1.png b/image/test/crashtests/1526717-1.png
new file mode 100644
index 0000000000..5ac5b32744
--- /dev/null
+++ b/image/test/crashtests/1526717-1.png
Binary files differ
diff --git a/image/test/crashtests/1629490-1-iframe.html b/image/test/crashtests/1629490-1-iframe.html
new file mode 100644
index 0000000000..2d20e28eed
--- /dev/null
+++ b/image/test/crashtests/1629490-1-iframe.html
@@ -0,0 +1 @@
+<img id="image1" src="finite-apng.png">
diff --git a/image/test/crashtests/1629490-1.html b/image/test/crashtests/1629490-1.html
new file mode 100644
index 0000000000..f35568ca4e
--- /dev/null
+++ b/image/test/crashtests/1629490-1.html
@@ -0,0 +1,49 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<head>
+</head>
+<body>
+<div id="container">
+ <iframe id='if' src="1629490-1-iframe.html"></iframe>
+</div>
+
+<script>
+let iterationsLeft = 25;
+
+function runTest() {
+ // Make sure the image is decoded and advanced to it's final frame.
+ let img = document.getElementById("if").contentWindow.document.getElementById("image1");
+ img.decode().then(function() {
+ setTimeout(forceDiscard, 2000);
+ });
+}
+
+function showIframe() {
+ document.getElementById("container").style.display = "";
+ document.documentElement.getBoundingClientRect();
+ requestAnimationFrame(forceDecode);
+}
+
+function forceDecode() {
+ let img = document.getElementById("if").contentWindow.document.getElementById("image1");
+ img.decode().then(function() {
+ setTimeout(forceDiscard, 0);
+ });
+}
+
+function forceDiscard() {
+ iterationsLeft--;
+ if (iterationsLeft < 0) {
+ document.documentElement.className = "";
+ return;
+ }
+ document.getElementById("container").style.display = "none";
+ document.documentElement.getBoundingClientRect();
+ requestAnimationFrame(() => { requestAnimationFrame( () => { setTimeout(showIframe, 0); } ) });
+}
+
+//window.addEventListener("load", runTest);
+window.addEventListener("MozReftestInvalidate", runTest);
+</script>
+</body>
+</html>
diff --git a/image/test/crashtests/1634839-1-iframe.html b/image/test/crashtests/1634839-1-iframe.html
new file mode 100644
index 0000000000..07c1b6545e
--- /dev/null
+++ b/image/test/crashtests/1634839-1-iframe.html
@@ -0,0 +1 @@
+<img id="image1" src="rainbow.gif">
diff --git a/image/test/crashtests/1634839-1.html b/image/test/crashtests/1634839-1.html
new file mode 100644
index 0000000000..865f83645f
--- /dev/null
+++ b/image/test/crashtests/1634839-1.html
@@ -0,0 +1,51 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<head>
+</head>
+<body>
+<div id="container">
+ <iframe id='if' src="1634839-1-iframe.html"></iframe>
+</div>
+
+<script>
+let iterationsLeft = 1;
+
+let img = null;
+
+function runTest() {
+ // Make sure the image is decoded and advanced to it's final frame.
+ img = document.getElementById("if").contentWindow.document.getElementById("image1");
+ img.decode().then(function() {
+ setTimeout(forceDiscard, 200);
+ });
+}
+
+function showIframe() {
+ document.getElementById("container").style.display = "";
+ document.documentElement.getBoundingClientRect();
+ requestAnimationFrame(forceDecode);
+}
+
+function forceDecode() {
+ img.decode().then(function() {
+ setTimeout(forceDiscard, 0);
+ });
+}
+
+function forceDiscard() {
+ iterationsLeft--;
+ if (iterationsLeft < 0) {
+ document.documentElement.className = "";
+ return;
+ }
+ document.getElementById("container").style.display = "none";
+ document.documentElement.getBoundingClientRect();
+ img.remove();
+ requestAnimationFrame(() => { requestAnimationFrame( () => { setTimeout(showIframe, 0); } ) });
+}
+
+//window.addEventListener("load", runTest);
+window.addEventListener("MozReftestInvalidate", runTest);
+</script>
+</body>
+</html>
diff --git a/image/test/crashtests/1634839-2-iframe.html b/image/test/crashtests/1634839-2-iframe.html
new file mode 100644
index 0000000000..6907844499
--- /dev/null
+++ b/image/test/crashtests/1634839-2-iframe.html
@@ -0,0 +1 @@
+<img id="image1" src="out2.gif">
diff --git a/image/test/crashtests/1634839-2.html b/image/test/crashtests/1634839-2.html
new file mode 100644
index 0000000000..d3629421fb
--- /dev/null
+++ b/image/test/crashtests/1634839-2.html
@@ -0,0 +1,51 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<head>
+</head>
+<body>
+<div id="container">
+ <iframe id='if' src="1634839-2-iframe.html"></iframe>
+</div>
+
+<script>
+let iterationsLeft = 1;
+
+let img = null;
+
+function runTest() {
+ // Make sure the image is decoded and advanced to it's final frame.
+ img = document.getElementById("if").contentWindow.document.getElementById("image1");
+ img.decode().then(function() {
+ setTimeout(forceDiscard, 1000);
+ });
+}
+
+function showIframe() {
+ document.getElementById("container").style.display = "";
+ document.documentElement.getBoundingClientRect();
+ requestAnimationFrame(forceDecode);
+}
+
+function forceDecode() {
+ img.decode().then(function() {
+ setTimeout(forceDiscard, 0);
+ });
+}
+
+function forceDiscard() {
+ iterationsLeft--;
+ if (iterationsLeft < 0) {
+ document.documentElement.className = "";
+ return;
+ }
+ document.getElementById("container").style.display = "none";
+ document.documentElement.getBoundingClientRect();
+ img.remove();
+ requestAnimationFrame(() => { requestAnimationFrame( () => { setTimeout(showIframe, 0); } ) });
+}
+
+//window.addEventListener("load", runTest);
+window.addEventListener("MozReftestInvalidate", runTest);
+</script>
+</body>
+</html>
diff --git a/image/test/crashtests/1676172-1-iframe.html b/image/test/crashtests/1676172-1-iframe.html
new file mode 100644
index 0000000000..c989c579bb
--- /dev/null
+++ b/image/test/crashtests/1676172-1-iframe.html
@@ -0,0 +1,13 @@
+<html>
+<head>
+ <script>
+ document.addEventListener('DOMContentLoaded', () => {
+ const image = document.createElementNS('http://www.w3.org/1999/xhtml', 'img')
+ var extra = document.location.search.substr(1);
+ image.setAttribute('src', '1676172-1.gif' + '?' + extra)
+ document.documentElement.appendChild(image)
+ setTimeout('location.reload()', 400)
+ })
+ </script>
+</head>
+</html>
diff --git a/image/test/crashtests/1676172-1.gif b/image/test/crashtests/1676172-1.gif
new file mode 100644
index 0000000000..c5635218d5
--- /dev/null
+++ b/image/test/crashtests/1676172-1.gif
Binary files differ
diff --git a/image/test/crashtests/1676172-1.html b/image/test/crashtests/1676172-1.html
new file mode 100644
index 0000000000..08374a4772
--- /dev/null
+++ b/image/test/crashtests/1676172-1.html
@@ -0,0 +1,57 @@
+<html class="reftest-wait">
+<head>
+<script>
+function setup() {
+ setTimeout(finish, 1500);
+}
+function finish() {
+ window.stop();
+ document.documentElement.className = "";
+}
+</script>
+<style>
+ iframe {
+ width: 100px;
+ height: 100px;
+ }
+</style>
+</head>
+<body onload="setup();">
+<script>
+let numiframes = 30;
+
+const Cc = SpecialPowers.Cc;
+const Ci = SpecialPowers.Ci;
+let isDebugBuild =
+ Cc["@mozilla.org/xpcom/debug;1"].getService(Ci.nsIDebug2).isDebugBuild;
+let isMac =
+ navigator.appVersion.toLowerCase().includes("mac") ||
+ navigator.platform.toLowerCase().includes("mac");
+
+// On some platforms too many animating and reloading gifs means we don't ever
+// get enough time to serve paints so that there is never a period of time
+// where there are no paints pending, so the reftest harness can't end the
+// test. So we limit the number on those platforms, since we only need one
+// iframe to reproduce the bug this is okay, more iframes just give more
+// chance of reproducing it on any given run.
+if (navigator.appVersion.includes("Windows")) {
+ numiframes = 16;
+}
+if (navigator.platform.includes("Linux")) {
+ numiframes = 10;
+}
+if (navigator.appVersion.includes("Android")) {
+ numiframes = 2;
+}
+if (isMac && isDebugBuild) {
+ numiframes = 20;
+}
+for (let i = 0; i < numiframes; i++) {
+ let ifr = document.createElement("iframe");
+ document.body.appendChild(ifr)
+ ifr.src = "1676172-1-iframe.html?" + i;
+}
+setTimeout(finish, 1500);
+</script>
+</body>
+</html>
diff --git a/image/test/crashtests/1763581-1-iframe.html b/image/test/crashtests/1763581-1-iframe.html
new file mode 100644
index 0000000000..6064183b9e
--- /dev/null
+++ b/image/test/crashtests/1763581-1-iframe.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <script>
+ window.onload = function() {
+ img = document.querySelector(".animated-image")
+ const staticImage = new Image();
+ staticImage.src = img.src;
+ }
+ </script>
+ </head>
+ <body>
+ <img class="animated-image" src="1763581-1.sjs">
+ </body>
+</html>
diff --git a/image/test/crashtests/1763581-1.gif b/image/test/crashtests/1763581-1.gif
new file mode 100644
index 0000000000..237d6a1722
--- /dev/null
+++ b/image/test/crashtests/1763581-1.gif
Binary files differ
diff --git a/image/test/crashtests/1763581-1.html b/image/test/crashtests/1763581-1.html
new file mode 100644
index 0000000000..167f541a24
--- /dev/null
+++ b/image/test/crashtests/1763581-1.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+window.onload = function() {
+ setTimeout(step, 500);
+}
+
+var reloads = 5;
+
+function step() {
+ if (--reloads) {
+ document.getElementById("ifr").contentWindow.location.reload();
+ } else {
+ document.documentElement.className = "";
+ }
+}
+
+function settimouestep() {
+ setTimeout(step, 500);
+}
+</script>
+</head>
+<body>
+ <iframe id="ifr" src="1763581-1-iframe.html" height="500" width="400" onload="settimouestep()"></iframe>
+</body>
+</html>
+
diff --git a/image/test/crashtests/1763581-1.sjs b/image/test/crashtests/1763581-1.sjs
new file mode 100644
index 0000000000..9fb70dd463
--- /dev/null
+++ b/image/test/crashtests/1763581-1.sjs
@@ -0,0 +1,71 @@
+
+function getFileStream(filename)
+{
+ // Get the location of this sjs file, and then use that to figure out where
+ // to find where our other files are.
+ var self = Components.classes["@mozilla.org/file/local;1"]
+ .createInstance(Components.interfaces.nsIFile);
+ self.initWithPath(getState("__LOCATION__"));
+ var file = self.parent;
+ file.append(filename);
+
+ var fileStream = Components.classes['@mozilla.org/network/file-input-stream;1']
+ .createInstance(Components.interfaces.nsIFileInputStream);
+ fileStream.init(file, 1, 0, false);
+
+ return fileStream;
+}
+
+// stolen from file_blocked_script.sjs
+function setGlobalState(data, key) {
+ x = {
+ data,
+ QueryInterface: ChromeUtils.generateQI([]),
+ };
+ x.wrappedJSObject = x;
+ setObjectState(key, x);
+}
+
+function getGlobalState(key) {
+ var data;
+ getObjectState(key, function(x) {
+ data = x && x.wrappedJSObject.data;
+ });
+ return data;
+}
+
+const DELAY_MS = 100;
+let gTimer;
+
+function handleRequest(request, response) {
+ let count = getGlobalState("count");
+ if (count == null) {
+ count = 0;
+ }
+
+ if (count > 0) {
+ response.processAsync();
+
+ gTimer = Cc["@mozilla.org/timer;1"].createInstance(Ci.nsITimer);
+ gTimer.init(
+ () => {
+ response.setStatusLine(request.httpVersion, 304, "Not Modified");
+ response.finish();
+ },
+ DELAY_MS,
+ Ci.nsITimer.TYPE_ONE_SHOT
+ );
+
+ return;
+ }
+
+ response.setStatusLine(request.httpVersion, 200, "OK");
+ response.setHeader("Content-Type", "image/gif", false);
+
+ var inputStream = getFileStream("1763581-1.gif");
+ response.bodyOutputStream.writeFrom(inputStream, inputStream.available());
+ inputStream.close();
+
+ count++;
+ setGlobalState(count, "count");
+}
diff --git a/image/test/crashtests/1765871-1.jpg b/image/test/crashtests/1765871-1.jpg
new file mode 100644
index 0000000000..11460a62c3
--- /dev/null
+++ b/image/test/crashtests/1765871-1.jpg
Binary files differ
diff --git a/image/test/crashtests/1814553.avif b/image/test/crashtests/1814553.avif
new file mode 100644
index 0000000000..7e2f040c53
--- /dev/null
+++ b/image/test/crashtests/1814553.avif
Binary files differ
diff --git a/image/test/crashtests/1814561.avif b/image/test/crashtests/1814561.avif
new file mode 100644
index 0000000000..33ad44d2a3
--- /dev/null
+++ b/image/test/crashtests/1814561.avif
Binary files differ
diff --git a/image/test/crashtests/1814677.avif b/image/test/crashtests/1814677.avif
new file mode 100644
index 0000000000..b91d4f955b
--- /dev/null
+++ b/image/test/crashtests/1814677.avif
Binary files differ
diff --git a/image/test/crashtests/1814708.avif b/image/test/crashtests/1814708.avif
new file mode 100644
index 0000000000..21a39cfa4d
--- /dev/null
+++ b/image/test/crashtests/1814708.avif
Binary files differ
diff --git a/image/test/crashtests/1814741.avif b/image/test/crashtests/1814741.avif
new file mode 100644
index 0000000000..842eaea1c1
--- /dev/null
+++ b/image/test/crashtests/1814741.avif
Binary files differ
diff --git a/image/test/crashtests/1814774.avif b/image/test/crashtests/1814774.avif
new file mode 100644
index 0000000000..77ffba7af2
--- /dev/null
+++ b/image/test/crashtests/1814774.avif
Binary files differ
diff --git a/image/test/crashtests/1817108.avif b/image/test/crashtests/1817108.avif
new file mode 100644
index 0000000000..a06b923ee4
--- /dev/null
+++ b/image/test/crashtests/1817108.avif
Binary files differ
diff --git a/image/test/crashtests/256-height.ico b/image/test/crashtests/256-height.ico
new file mode 100644
index 0000000000..6a3c5c1944
--- /dev/null
+++ b/image/test/crashtests/256-height.ico
Binary files differ
diff --git a/image/test/crashtests/256-width.ico b/image/test/crashtests/256-width.ico
new file mode 100644
index 0000000000..a82983ce4f
--- /dev/null
+++ b/image/test/crashtests/256-width.ico
Binary files differ
diff --git a/image/test/crashtests/463696.bmp b/image/test/crashtests/463696.bmp
new file mode 100644
index 0000000000..ec80d54126
--- /dev/null
+++ b/image/test/crashtests/463696.bmp
Binary files differ
diff --git a/image/test/crashtests/523528-1.gif b/image/test/crashtests/523528-1.gif
new file mode 100644
index 0000000000..abadca7ad2
--- /dev/null
+++ b/image/test/crashtests/523528-1.gif
Binary files differ
diff --git a/image/test/crashtests/523528-2.gif b/image/test/crashtests/523528-2.gif
new file mode 100644
index 0000000000..5be3bd46f6
--- /dev/null
+++ b/image/test/crashtests/523528-2.gif
Binary files differ
diff --git a/image/test/crashtests/570451.png b/image/test/crashtests/570451.png
new file mode 100644
index 0000000000..c49f2d11f1
--- /dev/null
+++ b/image/test/crashtests/570451.png
Binary files differ
diff --git a/image/test/crashtests/694165-1.xhtml b/image/test/crashtests/694165-1.xhtml
new file mode 100644
index 0000000000..1e340a0f2f
--- /dev/null
+++ b/image/test/crashtests/694165-1.xhtml
@@ -0,0 +1,510 @@
+<!DOCTYPE html [
+ <!ENTITY thousand-g-elements "
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+">
+
+]>
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+<img src='data:image/svg+xml,&lt;svg xmlns="http://www.w3.org/2000/svg"&gt;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &lt;/svg&gt;'/>
+</html>
diff --git a/image/test/crashtests/732319-1.html b/image/test/crashtests/732319-1.html
new file mode 100644
index 0000000000..b9d9c6de87
--- /dev/null
+++ b/image/test/crashtests/732319-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<img crossorigin src="data:a/a,">
diff --git a/image/test/crashtests/83804-1.gif b/image/test/crashtests/83804-1.gif
new file mode 100644
index 0000000000..3967c703f6
--- /dev/null
+++ b/image/test/crashtests/83804-1.gif
Binary files differ
diff --git a/image/test/crashtests/844403-1.html b/image/test/crashtests/844403-1.html
new file mode 100644
index 0000000000..ef207c0f9f
--- /dev/null
+++ b/image/test/crashtests/844403-1.html
@@ -0,0 +1,10 @@
+<color style='background-image: url("data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZlcnNpb249IjEuMSINCiAgICAgd2lkdGg9IjEwMCIgaGVpZ2h0PSIxMDAiPg0KICA8cmVjdCB3aWR0aD0iMTAwJSIgaGVpZ2h0PSIxMDAlIiBmaWxsPSJibHVlIi8%2BDQo8L3N2Zz4NCg%3D%3D");'></color>
+<iframe contenteditable=true></iframe>
+<script>
+ document.body.innerHTML = '';
+ function onload() {
+ e = document.createElementNS("http://www.w3.org/1998/Math/MathML", "share");
+ document.body.appendChild(e);
+ }
+ document.addEventListener("DOMContentLoaded", onload);
+</script>
diff --git a/image/test/crashtests/856616.gif b/image/test/crashtests/856616.gif
new file mode 100644
index 0000000000..0fac811014
--- /dev/null
+++ b/image/test/crashtests/856616.gif
Binary files differ
diff --git a/image/test/crashtests/89341-1.gif b/image/test/crashtests/89341-1.gif
new file mode 100644
index 0000000000..14b3892d17
--- /dev/null
+++ b/image/test/crashtests/89341-1.gif
Binary files differ
diff --git a/image/test/crashtests/944353.jpg b/image/test/crashtests/944353.jpg
new file mode 100644
index 0000000000..fd81c58263
--- /dev/null
+++ b/image/test/crashtests/944353.jpg
Binary files differ
diff --git a/image/test/crashtests/colormap-range.gif b/image/test/crashtests/colormap-range.gif
new file mode 100644
index 0000000000..887add653f
--- /dev/null
+++ b/image/test/crashtests/colormap-range.gif
Binary files differ
diff --git a/image/test/crashtests/crashtests.list b/image/test/crashtests/crashtests.list
new file mode 100644
index 0000000000..055ad677a1
--- /dev/null
+++ b/image/test/crashtests/crashtests.list
@@ -0,0 +1,84 @@
+# Bug 668068 - Maximum (256) width and height icons that we currently interpret as 0-width and 0-height.
+load 256-height.ico
+load 256-width.ico
+
+load 83804-1.gif
+load 89341-1.gif
+load 463696.bmp
+load 570451.png
+# Bug 1390704 - Skip on debug because it triggers a quadratic behavior that makes it take
+# so much time that it can trip on the reftest timeout of 5 minutes.
+skip-if(Android||isDebugBuild||ThreadSanitizer) load 694165-1.xhtml
+load 732319-1.html
+load 844403-1.html
+load 856616.gif
+skip-if(ThreadSanitizer) load 944353.jpg
+load 1205923-1.html
+# Ensure we handle detecting that an image is animated, then failing to decode
+# it. (See bug 1210745.)
+load 1210745-1.gif
+load 1212954-1.svg
+load 1235605.gif
+load 1241728-1.html
+load 1241729-1.html
+load 1242093-1.html
+skip-if(/^Windows\x20NT\x2010\.0/.test(http.oscpu)&&/^aarch64-msvc/.test(xulRuntime.XPCOMABI)) load 1242778-1.png
+load 1249576-1.png
+load 1253362-1.html
+skip-if(Android&&browserIsRemote) load 1355898-1.html # bug 1507207
+load 1375842-1.html
+load 1413762-1.gif
+pref(image.downscale-during-decode.enabled,true) load 1443232-1.html
+load colormap-range.gif
+HTTP load delayedframe.sjs # A 3-frame animated GIF with an inordinate delay between the second and third frame
+
+# Animated gifs with a very large canvas, but tiny actual content.
+load delaytest.html?523528-1.gif
+load delaytest.html?523528-2.gif
+
+load delaytest.html?1262549-1.gif
+load delaytest.html?1277397-1.jpg
+load delaytest.html?1277397-2.jpg
+
+# Bug 1160801 - Ensure that we handle invalid disposal types.
+load invalid-disposal-method-1.gif
+load invalid-disposal-method-2.gif
+load invalid-disposal-method-3.gif
+
+load invalid-icc-profile.jpg # This would have exposed the leak discovered in bug 642902
+
+# Ensure we handle ICO directory entries which specify the wrong size for the contained resource.
+load invalid_ico_height.ico
+load invalid_ico_width.ico
+
+# Bug 525326 - Test image sizes of 65535x65535 which is larger than we allow)
+load invalid-size.gif
+load invalid-size-second-frame.gif
+
+load multiple-png-hassize.ico # Bug 863958 - This icon's size is such that it leads to multiple writes to the PNG decoder after we've gotten our size.
+skip-if(ThreadSanitizer) asserts(0-2) load ownerdiscard.html # Bug 1323672, bug 807211
+load truncated-second-frame.png # Bug 863975
+
+# Bug 1509998 - Ensure that we handle empty frame rects in animated images.
+load 1509998.gif
+
+load 1526717-1.html
+skip-if(ThreadSanitizer) pref(widget.windows.window_occlusion_tracking.enabled,false) load 1629490-1.html # Bug 1819154
+
+pref(widget.windows.window_occlusion_tracking.enabled,false) HTTP load 1634839-1.html # Bug 1819154
+pref(widget.windows.window_occlusion_tracking.enabled,false) HTTP load 1634839-2.html # Bug 1819154
+pref(image.animated.decode-on-demand.batch-size,1) pref(image.animated.decode-on-demand.threshold-kb,0) HTTP load 1676172-1.html
+pref(browser.soft_reload.only_force_validate_top_level_document,false) HTTP load 1763581-1.html
+load 1765871-1.jpg
+
+load 1814561.avif
+load 1814708.avif
+
+load 1814553.avif
+
+load 1814677.avif
+
+load 1814741.avif
+
+load 1814774.avif
+load 1817108.avif
diff --git a/image/test/crashtests/delayedframe.sjs b/image/test/crashtests/delayedframe.sjs
new file mode 100644
index 0000000000..0cd7ce97e9
--- /dev/null
+++ b/image/test/crashtests/delayedframe.sjs
@@ -0,0 +1,44 @@
+function getFileStream(filename)
+{
+ // Get the location of this sjs file, and then use that to figure out where
+ // to find where our other files are.
+ var self = Components.classes["@mozilla.org/file/local;1"]
+ .createInstance(Components.interfaces.nsIFile);
+ self.initWithPath(getState("__LOCATION__"));
+ var file = self.parent;
+ file.append(filename);
+ dump(file.path + "\n");
+
+ var fileStream = Components.classes['@mozilla.org/network/file-input-stream;1']
+ .createInstance(Components.interfaces.nsIFileInputStream);
+ fileStream.init(file, 1, 0, false);
+
+ return fileStream;
+}
+
+var gTimer;
+
+function handleRequest(request, response)
+{
+ response.processAsync();
+ response.setStatusLine(request.httpVersion, 200, "OK");
+ response.setHeader("Content-Type", "image/gif", false);
+
+ var firststream = getFileStream("threeframes-start.gif");
+ response.bodyOutputStream.writeFrom(firststream, firststream.available())
+ firststream.close();
+
+ gTimer = Components.classes["@mozilla.org/timer;1"].createInstance(Components.interfaces.nsITimer);
+ gTimer.initWithCallback(function()
+ {
+ var secondstream = getFileStream("threeframes-end.gif");
+ response.bodyOutputStream.writeFrom(secondstream, secondstream.available())
+ secondstream.close();
+ response.finish();
+
+ // This time needs to be longer than the animation timer in
+ // threeframes-start.gif. That's specified as 100ms; just use 5 seconds as
+ // a reasonable upper bound. Since this is just a crashtest, timeouts
+ // aren't a big deal.
+ }, 5 * 1000 /* milliseconds */, Components.interfaces.nsITimer.TYPE_ONE_SHOT);
+}
diff --git a/image/test/crashtests/delaytest.html b/image/test/crashtests/delaytest.html
new file mode 100644
index 0000000000..fb368c1e90
--- /dev/null
+++ b/image/test/crashtests/delaytest.html
@@ -0,0 +1,59 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<head>
+<title>Delayed image reftest wrapper</title>
+</head>
+<body>
+<!-- non-empty alt to avoid the broken image icon -->
+<img id="image1" alt=" ">
+<script>
+
+window.addEventListener("MozReftestInvalidate", reftestInvalidateListener);
+
+// This loads a externally specified image, forces a draw (in case of
+// decode-on-draw), waits 350ms, and then triggers the reftest snapshot.
+// This allows the animation on the page to complete.
+//
+// Use as "delaytest.html?animation.png"
+//
+
+// Get the image URL from our URL
+var imgURL = document.location.search.substr(1);
+
+// Load the image
+var img = document.images[0];
+img.src = imgURL;
+img.onload = forceDecode;
+img.onerror = forceDecode;
+
+let decodeComplete = false;
+let gotReftestInvalidate = false;
+
+function forceDecode() {
+ img.decode().then(function() {
+ decodeComplete = true;
+ maybeStartTimer();
+ }, function() {
+ decodeComplete = true;
+ maybeStartTimer();
+ });
+}
+
+function reftestInvalidateListener() {
+ gotReftestInvalidate = true;
+ maybeStartTimer();
+}
+
+function maybeStartTimer() {
+ if (decodeComplete && gotReftestInvalidate) {
+ startTimer();
+ }
+}
+
+function startTimer() {
+ const delay = 350;
+ setTimeout("document.documentElement.className = '';", delay);
+}
+</script>
+</body>
+</html>
diff --git a/image/test/crashtests/discardframe.htm b/image/test/crashtests/discardframe.htm
new file mode 100644
index 0000000000..5ced0029c5
--- /dev/null
+++ b/image/test/crashtests/discardframe.htm
@@ -0,0 +1 @@
+<img src=ie.png>
diff --git a/image/test/crashtests/finite-apng.png b/image/test/crashtests/finite-apng.png
new file mode 100644
index 0000000000..778613d851
--- /dev/null
+++ b/image/test/crashtests/finite-apng.png
Binary files differ
diff --git a/image/test/crashtests/ie.png b/image/test/crashtests/ie.png
new file mode 100644
index 0000000000..74c4a1a323
--- /dev/null
+++ b/image/test/crashtests/ie.png
Binary files differ
diff --git a/image/test/crashtests/invalid-disposal-method-1.gif b/image/test/crashtests/invalid-disposal-method-1.gif
new file mode 100644
index 0000000000..30c61de188
--- /dev/null
+++ b/image/test/crashtests/invalid-disposal-method-1.gif
Binary files differ
diff --git a/image/test/crashtests/invalid-disposal-method-2.gif b/image/test/crashtests/invalid-disposal-method-2.gif
new file mode 100644
index 0000000000..66158d81a9
--- /dev/null
+++ b/image/test/crashtests/invalid-disposal-method-2.gif
Binary files differ
diff --git a/image/test/crashtests/invalid-disposal-method-3.gif b/image/test/crashtests/invalid-disposal-method-3.gif
new file mode 100644
index 0000000000..0da0723773
--- /dev/null
+++ b/image/test/crashtests/invalid-disposal-method-3.gif
Binary files differ
diff --git a/image/test/crashtests/invalid-icc-profile.jpg b/image/test/crashtests/invalid-icc-profile.jpg
new file mode 100644
index 0000000000..938c7713ce
--- /dev/null
+++ b/image/test/crashtests/invalid-icc-profile.jpg
Binary files differ
diff --git a/image/test/crashtests/invalid-size-second-frame.gif b/image/test/crashtests/invalid-size-second-frame.gif
new file mode 100644
index 0000000000..22005ae4ca
--- /dev/null
+++ b/image/test/crashtests/invalid-size-second-frame.gif
Binary files differ
diff --git a/image/test/crashtests/invalid-size.gif b/image/test/crashtests/invalid-size.gif
new file mode 100644
index 0000000000..665ca9b5dc
--- /dev/null
+++ b/image/test/crashtests/invalid-size.gif
Binary files differ
diff --git a/image/test/crashtests/invalid_ico_height.ico b/image/test/crashtests/invalid_ico_height.ico
new file mode 100644
index 0000000000..50d6842278
--- /dev/null
+++ b/image/test/crashtests/invalid_ico_height.ico
Binary files differ
diff --git a/image/test/crashtests/invalid_ico_width.ico b/image/test/crashtests/invalid_ico_width.ico
new file mode 100644
index 0000000000..4ace07c16f
--- /dev/null
+++ b/image/test/crashtests/invalid_ico_width.ico
Binary files differ
diff --git a/image/test/crashtests/multiple-png-hassize.ico b/image/test/crashtests/multiple-png-hassize.ico
new file mode 100644
index 0000000000..6944220018
--- /dev/null
+++ b/image/test/crashtests/multiple-png-hassize.ico
Binary files differ
diff --git a/image/test/crashtests/out2.gif b/image/test/crashtests/out2.gif
new file mode 100644
index 0000000000..f062c7f20c
--- /dev/null
+++ b/image/test/crashtests/out2.gif
Binary files differ
diff --git a/image/test/crashtests/ownerdiscard.html b/image/test/crashtests/ownerdiscard.html
new file mode 100644
index 0000000000..2e5be86023
--- /dev/null
+++ b/image/test/crashtests/ownerdiscard.html
@@ -0,0 +1,48 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<body>
+ <div id=tCF0>
+ <img id=victim src=ie.png>
+ <iframe src=discardframe.htm></iframe>
+ </div>
+ <script>
+ const Ci = SpecialPowers.Ci;
+ const Cc = SpecialPowers.Cc;
+
+ function ImageDecoderObserverStub()
+ {
+ this.sizeAvailable = function sizeAvailable(aRequest) {}
+ this.frameComplete = function frameComplete(aRequest) {}
+ this.decodeComplete = function decodeComplete(aRequest) {}
+ this.loadComplete = function loadComplete(aRequest) {}
+ this.frameUpdate = function frameUpdate(aRequest) {}
+ this.discard = function discard(aRequest) {}
+ this.isAnimated = function isAnimated(aRequest) {}
+ }
+ var img = document.getElementById('victim');
+ var observer = new ImageDecoderObserverStub();
+ observer.discard = function() {
+ cleanupAndFinish();
+ }
+ observer = SpecialPowers.wrapCallbackObject(observer);
+ var gObserver = Cc["@mozilla.org/image/tools;1"].getService(Ci.imgITools)
+ .createScriptedObserver(observer);
+ var imgLoadingContent = SpecialPowers.wrap(img);
+ imgLoadingContent.addObserver(gObserver);
+ function initCF() {
+ setTimeout(function() { document.adoptNode(tCF0); }, 0);
+ }
+ document.addEventListener("DOMContentLoaded", initCF);
+
+ function cleanupAndFinish() {
+ imgLoadingContent.removeObserver(gObserver);
+ setTimeout("document.documentElement.className = '';", 0);
+ }
+ function loadhandler() {
+ setTimeout("cleanupAndFinish();", 30000);
+ }
+ window.addEventListener("load", function() {
+ SpecialPowers.pushPrefEnv({"set":[["min_discard_timeout_ms", 1]]}, loadhandler)});
+ </script>
+</body>
+</html>
diff --git a/image/test/crashtests/rainbow.gif b/image/test/crashtests/rainbow.gif
new file mode 100644
index 0000000000..72a7816928
--- /dev/null
+++ b/image/test/crashtests/rainbow.gif
Binary files differ
diff --git a/image/test/crashtests/threeframes-end.gif b/image/test/crashtests/threeframes-end.gif
new file mode 100644
index 0000000000..baf6a418c2
--- /dev/null
+++ b/image/test/crashtests/threeframes-end.gif
Binary files differ
diff --git a/image/test/crashtests/threeframes-start.gif b/image/test/crashtests/threeframes-start.gif
new file mode 100644
index 0000000000..bc641a3166
--- /dev/null
+++ b/image/test/crashtests/threeframes-start.gif
Binary files differ
diff --git a/image/test/crashtests/truncated-second-frame.png b/image/test/crashtests/truncated-second-frame.png
new file mode 100644
index 0000000000..0aef5e44de
--- /dev/null
+++ b/image/test/crashtests/truncated-second-frame.png
Binary files differ
diff --git a/image/test/crashtests/unsized-svg.svg b/image/test/crashtests/unsized-svg.svg
new file mode 100644
index 0000000000..714efc7ef0
--- /dev/null
+++ b/image/test/crashtests/unsized-svg.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg"></svg>