7 files changed, 90 insertions, 0 deletions
diff --git a/image/test/reftest/ico/ico-bmp-corrupted/16x16.png b/image/test/reftest/ico/ico-bmp-corrupted/16x16.png
new file mode 100644
index 0000000000..c04869e728
--- /dev/null
+++ b/image/test/reftest/ico/ico-bmp-corrupted/16x16.png
diff --git a/image/test/reftest/ico/ico-bmp-corrupted/invalid-bpp.ico b/image/test/reftest/ico/ico-bmp-corrupted/invalid-bpp.ico
new file mode 100644
index 0000000000..1189e4c040
--- /dev/null
+++ b/image/test/reftest/ico/ico-bmp-corrupted/invalid-bpp.ico
diff --git a/image/test/reftest/ico/ico-bmp-corrupted/invalid-compression-RLE4.ico b/image/test/reftest/ico/ico-bmp-corrupted/invalid-compression-RLE4.ico
new file mode 100644
index 0000000000..8fd0a5d658
--- /dev/null
+++ b/image/test/reftest/ico/ico-bmp-corrupted/invalid-compression-RLE4.ico
diff --git a/image/test/reftest/ico/ico-bmp-corrupted/invalid-compression-RLE8.ico b/image/test/reftest/ico/ico-bmp-corrupted/invalid-compression-RLE8.ico
new file mode 100644
index 0000000000..1f185ca620
--- /dev/null
+++ b/image/test/reftest/ico/ico-bmp-corrupted/invalid-compression-RLE8.ico
diff --git a/image/test/reftest/ico/ico-bmp-corrupted/invalid-compression.ico b/image/test/reftest/ico/ico-bmp-corrupted/invalid-compression.ico
new file mode 100644
index 0000000000..a49a783c5f
--- /dev/null
+++ b/image/test/reftest/ico/ico-bmp-corrupted/invalid-compression.ico
diff --git a/image/test/reftest/ico/ico-bmp-corrupted/reftest.list b/image/test/reftest/ico/ico-bmp-corrupted/reftest.list
new file mode 100644
index 0000000000..2467b1323e
--- /dev/null
+++ b/image/test/reftest/ico/ico-bmp-corrupted/reftest.list
@@ -0,0 +1,10 @@
+# ICOs containing corrupted BMP tests
+
+# Invalid value for bits per pixel (BPP) - detected when decoding the header.
+== wrapper.html?invalid-bpp.ico about:blank
+# Invalid BPP values for RLE4 - detected when decoding the image data.
+== wrapper.html?invalid-compression-RLE4.ico about:blank
+# Invalid BPP values for RLE8 - detected when decoding the image data.
+== wrapper.html?invalid-compression-RLE8.ico about:blank
+# Invalid compression value - detected when decoding the image data.
+== wrapper.html?invalid-compression.ico about:blank
diff --git a/image/test/reftest/ico/ico-bmp-corrupted/wrapper.html b/image/test/reftest/ico/ico-bmp-corrupted/wrapper.html
new file mode 100644
index 0000000000..943bc75bf2
--- /dev/null
+++ b/image/test/reftest/ico/ico-bmp-corrupted/wrapper.html
@@ -0,0 +1,80 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<head>
+<title>Image reftest wrapper</title>
+<style type="text/css">
+  #image1 { background-color: rgb(10, 100, 250); }
+</style>
+<script>
+  var gImg;
+
+  function runAfterAsyncEvents(aCallback) {
+    function handlePostMessage(aEvent) {
+      if (aEvent.data == 'next') {
+        window.removeEventListener('message', handlePostMessage);
+        aCallback();
+      }
+    }
+
+    window.addEventListener('message', handlePostMessage);
+
+    // We'll receive the 'message' event after everything else that's currently in
+    // the event queue (which is a stronger guarantee than setTimeout, because
+    // setTimeout events may be coalesced). This lets us ensure that we run
+    // aCallback *after* any asynchronous events are delivered.
+    window.postMessage('next', '*');
+  }
+
+  // The image is loaded async after the page loads
+  // wait for it to finish loading
+  function onImageLoad() { 
+    // Use a canvas to force the image to get sync decoded.
+    var canvas = document.createElement('canvas');
+    var ctx = canvas.getContext('2d');
+
+    try {
+      ctx.drawImage(gImg, 0, 0);
+    } catch (e) {
+    }
+
+    // Continue after pumping the event loop.
+    runAfterAsyncEvents(step2);
+  }
+
+  function step2() {
+    // Only now, once the image has already been sync decoded, do we load it in
+    // the <img> element we're going to snapshot. That's because for some of the
+    // tests that use wrapper.html, an error is only detected when decoding the
+    // actual image data - i.e., the error isn't detected in the header. The
+    // precise time when we detect the error, unfortunately, affects how we draw
+    // the image. This will be fixed in bug 1182531, and then we can simplify this
+    // code.
+
+    var finalImg = document.getElementById('image1');
+    finalImg.onload = finalImg.onerror = step3;
+    finalImg.src = gImg.src;
+  }
+
+  function step3() {
+    // We're ready to take the snapshot, but pump the event loop first just to
+    // be sure that everything has settled down.
+    runAfterAsyncEvents(takeSnapshot);
+  }
+
+  function takeSnapshot() {
+    document.documentElement.removeAttribute("class");
+  }
+</script>
+</head>
+<body>
+<!-- non-empty alt to avoid the broken image icon -->
+<img id="image1" alt=" ">
+<script>
+  // Use as "wrapper.html?image.png
+  gImg = document.createElement('img');
+  gImg.onload = gImg.onerror = onImageLoad;
+  gImg.src = document.location.search.substr(1);
+</script>
+</body>
+</html>
+