From 36d22d82aa202bb199967e9512281e9a53db42c9 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Sun, 7 Apr 2024 21:33:14 +0200
Subject: Adding upstream version 115.7.0esr.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 dom/animation/test/crashtests/1134538.html         |  8 +++
 dom/animation/test/crashtests/1216842-1.html       | 35 +++++++++++++
 dom/animation/test/crashtests/1216842-2.html       | 35 +++++++++++++
 dom/animation/test/crashtests/1216842-3.html       | 27 ++++++++++
 dom/animation/test/crashtests/1216842-4.html       | 27 ++++++++++
 dom/animation/test/crashtests/1216842-5.html       | 38 ++++++++++++++
 dom/animation/test/crashtests/1216842-6.html       | 38 ++++++++++++++
 dom/animation/test/crashtests/1239889-1.html       | 16 ++++++
 dom/animation/test/crashtests/1244595-1.html       |  3 ++
 dom/animation/test/crashtests/1272475-1.html       | 20 +++++++
 dom/animation/test/crashtests/1272475-2.html       | 20 +++++++
 dom/animation/test/crashtests/1277272-1-inner.html | 19 +++++++
 dom/animation/test/crashtests/1277272-1.html       | 25 +++++++++
 dom/animation/test/crashtests/1278485-1.html       | 26 +++++++++
 dom/animation/test/crashtests/1282691-1.html       | 23 ++++++++
 dom/animation/test/crashtests/1291413-1.html       | 20 +++++++
 dom/animation/test/crashtests/1291413-2.html       | 21 ++++++++
 dom/animation/test/crashtests/1304886-1.html       | 14 +++++
 dom/animation/test/crashtests/1309198-1.html       | 40 ++++++++++++++
 dom/animation/test/crashtests/1322291-1.html       | 24 +++++++++
 dom/animation/test/crashtests/1322291-2.html       | 31 +++++++++++
 dom/animation/test/crashtests/1322382-1.html       | 16 ++++++
 dom/animation/test/crashtests/1323114-1.html       | 12 +++++
 dom/animation/test/crashtests/1323114-2.html       | 18 +++++++
 dom/animation/test/crashtests/1323119-1.html       | 13 +++++
 dom/animation/test/crashtests/1324554-1.html       | 19 +++++++
 dom/animation/test/crashtests/1325193-1.html       | 18 +++++++
 dom/animation/test/crashtests/1330190-1.html       | 11 ++++
 dom/animation/test/crashtests/1330190-2.html       | 36 +++++++++++++
 dom/animation/test/crashtests/1330513-1.html       |  8 +++
 dom/animation/test/crashtests/1332588-1.html       | 25 +++++++++
 dom/animation/test/crashtests/1333539-1.html       | 30 +++++++++++
 dom/animation/test/crashtests/1333539-2.html       | 38 ++++++++++++++
 dom/animation/test/crashtests/1334582-1.html       | 11 ++++
 dom/animation/test/crashtests/1334582-2.html       | 11 ++++
 dom/animation/test/crashtests/1334583-1.html       |  9 ++++
 dom/animation/test/crashtests/1335998-1.html       | 28 ++++++++++
 dom/animation/test/crashtests/1343589-1.html       | 18 +++++++
 dom/animation/test/crashtests/1359658-1.html       | 33 ++++++++++++
 dom/animation/test/crashtests/1373712-1.html       | 11 ++++
 dom/animation/test/crashtests/1379606-1.html       | 21 ++++++++
 dom/animation/test/crashtests/1393605-1.html       | 15 ++++++
 dom/animation/test/crashtests/1400022-1.html       | 10 ++++
 dom/animation/test/crashtests/1401809.html         | 14 +++++
 dom/animation/test/crashtests/1411318-1.html       | 15 ++++++
 dom/animation/test/crashtests/1467277-1.html       |  6 +++
 dom/animation/test/crashtests/1468294-1.html       |  7 +++
 dom/animation/test/crashtests/1524480-1.html       | 37 +++++++++++++
 dom/animation/test/crashtests/1575926.html         | 24 +++++++++
 dom/animation/test/crashtests/1585770.html         | 22 ++++++++
 dom/animation/test/crashtests/1604500-1.html       | 24 +++++++++
 dom/animation/test/crashtests/1611847.html         | 23 ++++++++
 dom/animation/test/crashtests/1612891-1.html       | 15 ++++++
 dom/animation/test/crashtests/1612891-2.html       | 15 ++++++
 dom/animation/test/crashtests/1612891-3.html       | 10 ++++
 dom/animation/test/crashtests/1633442.html         | 15 ++++++
 dom/animation/test/crashtests/1633486.html         | 20 +++++++
 dom/animation/test/crashtests/1656419.html         | 23 ++++++++
 dom/animation/test/crashtests/1699890.html         | 13 +++++
 dom/animation/test/crashtests/1706157.html         | 19 +++++++
 dom/animation/test/crashtests/1714421.html         |  8 +++
 dom/animation/test/crashtests/1807966.html         | 13 +++++
 dom/animation/test/crashtests/crashtests.list      | 61 ++++++++++++++++++++++
 63 files changed, 1305 insertions(+)
 create mode 100644 dom/animation/test/crashtests/1134538.html
 create mode 100644 dom/animation/test/crashtests/1216842-1.html
 create mode 100644 dom/animation/test/crashtests/1216842-2.html
 create mode 100644 dom/animation/test/crashtests/1216842-3.html
 create mode 100644 dom/animation/test/crashtests/1216842-4.html
 create mode 100644 dom/animation/test/crashtests/1216842-5.html
 create mode 100644 dom/animation/test/crashtests/1216842-6.html
 create mode 100644 dom/animation/test/crashtests/1239889-1.html
 create mode 100644 dom/animation/test/crashtests/1244595-1.html
 create mode 100644 dom/animation/test/crashtests/1272475-1.html
 create mode 100644 dom/animation/test/crashtests/1272475-2.html
 create mode 100644 dom/animation/test/crashtests/1277272-1-inner.html
 create mode 100644 dom/animation/test/crashtests/1277272-1.html
 create mode 100644 dom/animation/test/crashtests/1278485-1.html
 create mode 100644 dom/animation/test/crashtests/1282691-1.html
 create mode 100644 dom/animation/test/crashtests/1291413-1.html
 create mode 100644 dom/animation/test/crashtests/1291413-2.html
 create mode 100644 dom/animation/test/crashtests/1304886-1.html
 create mode 100644 dom/animation/test/crashtests/1309198-1.html
 create mode 100644 dom/animation/test/crashtests/1322291-1.html
 create mode 100644 dom/animation/test/crashtests/1322291-2.html
 create mode 100644 dom/animation/test/crashtests/1322382-1.html
 create mode 100644 dom/animation/test/crashtests/1323114-1.html
 create mode 100644 dom/animation/test/crashtests/1323114-2.html
 create mode 100644 dom/animation/test/crashtests/1323119-1.html
 create mode 100644 dom/animation/test/crashtests/1324554-1.html
 create mode 100644 dom/animation/test/crashtests/1325193-1.html
 create mode 100644 dom/animation/test/crashtests/1330190-1.html
 create mode 100644 dom/animation/test/crashtests/1330190-2.html
 create mode 100644 dom/animation/test/crashtests/1330513-1.html
 create mode 100644 dom/animation/test/crashtests/1332588-1.html
 create mode 100644 dom/animation/test/crashtests/1333539-1.html
 create mode 100644 dom/animation/test/crashtests/1333539-2.html
 create mode 100644 dom/animation/test/crashtests/1334582-1.html
 create mode 100644 dom/animation/test/crashtests/1334582-2.html
 create mode 100644 dom/animation/test/crashtests/1334583-1.html
 create mode 100644 dom/animation/test/crashtests/1335998-1.html
 create mode 100644 dom/animation/test/crashtests/1343589-1.html
 create mode 100644 dom/animation/test/crashtests/1359658-1.html
 create mode 100644 dom/animation/test/crashtests/1373712-1.html
 create mode 100644 dom/animation/test/crashtests/1379606-1.html
 create mode 100644 dom/animation/test/crashtests/1393605-1.html
 create mode 100644 dom/animation/test/crashtests/1400022-1.html
 create mode 100644 dom/animation/test/crashtests/1401809.html
 create mode 100644 dom/animation/test/crashtests/1411318-1.html
 create mode 100644 dom/animation/test/crashtests/1467277-1.html
 create mode 100644 dom/animation/test/crashtests/1468294-1.html
 create mode 100644 dom/animation/test/crashtests/1524480-1.html
 create mode 100644 dom/animation/test/crashtests/1575926.html
 create mode 100644 dom/animation/test/crashtests/1585770.html
 create mode 100644 dom/animation/test/crashtests/1604500-1.html
 create mode 100644 dom/animation/test/crashtests/1611847.html
 create mode 100644 dom/animation/test/crashtests/1612891-1.html
 create mode 100644 dom/animation/test/crashtests/1612891-2.html
 create mode 100644 dom/animation/test/crashtests/1612891-3.html
 create mode 100644 dom/animation/test/crashtests/1633442.html
 create mode 100644 dom/animation/test/crashtests/1633486.html
 create mode 100644 dom/animation/test/crashtests/1656419.html
 create mode 100644 dom/animation/test/crashtests/1699890.html
 create mode 100644 dom/animation/test/crashtests/1706157.html
 create mode 100644 dom/animation/test/crashtests/1714421.html
 create mode 100644 dom/animation/test/crashtests/1807966.html
 create mode 100644 dom/animation/test/crashtests/crashtests.list

(limited to 'dom/animation/test/crashtests')

diff --git a/dom/animation/test/crashtests/1134538.html b/dom/animation/test/crashtests/1134538.html
new file mode 100644
index 0000000000..136d63deee
--- /dev/null
+++ b/dom/animation/test/crashtests/1134538.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<div contenteditable=true style="transition-property: width;"></div>
+<style>
+html {
+  transition-delay: 18446744073709551584s;
+  transform: rotate(0deg);
+}
+</style>
diff --git a/dom/animation/test/crashtests/1216842-1.html b/dom/animation/test/crashtests/1216842-1.html
new file mode 100644
index 0000000000..6ac40b2fb8
--- /dev/null
+++ b/dom/animation/test/crashtests/1216842-1.html
@@ -0,0 +1,35 @@
+<!doctype html>
+<html class="reftest-wait">
+  <head>
+    <title>Bug 1216842: effect-level easing function produces negative values (compositor thread)</title>
+    <style>
+    #target {
+      width: 100px; height: 100px;
+      background: blue;
+    }
+    </style>
+  </head>
+  <body>
+  <div id="target"></div>
+  </body>
+  <script>
+    var target = document.getElementById("target");
+    var effect =
+      new KeyframeEffect(
+        target,
+        { opacity: [0, 1] },
+        {
+          fill: "forwards",
+          /* The function produces negative values in (0, 0.766312060) */
+          easing: "cubic-bezier(0,-0.5,1,-0.5)",
+          duration: 100,
+          iterations: 0.75 /* To finish in the extraporation range */
+        }
+      );
+    var animation = new Animation(effect, document.timeline);
+    animation.play();
+    animation.finished.then(function() {
+      document.documentElement.className = "";
+    });
+  </script>
+</html>
diff --git a/dom/animation/test/crashtests/1216842-2.html b/dom/animation/test/crashtests/1216842-2.html
new file mode 100644
index 0000000000..7bae8a3116
--- /dev/null
+++ b/dom/animation/test/crashtests/1216842-2.html
@@ -0,0 +1,35 @@
+<!doctype html>
+<html class="reftest-wait">
+  <head>
+    <title>Bug 1216842: effect-level easing function produces values greater than 1 (compositor thread)</title>
+    <style>
+    #target {
+      width: 100px; height: 100px;
+      background: blue;
+    }
+    </style>
+  </head>
+  <body>
+  <div id="target"></div>
+  </body>
+  <script>
+    var target = document.getElementById("target");
+    var effect =
+      new KeyframeEffect(
+        target,
+        { opacity: [0, 1] },
+        {
+          fill: "forwards",
+          /* The function produces values greater than 1 in (0.23368794, 1) */
+          easing: "cubic-bezier(0,1.5,1,1.5)",
+          duration: 100,
+          iterations: 0.25 /* To finish in the extraporation range */
+        }
+      );
+    var animation = new Animation(effect, document.timeline);
+    animation.play();
+    animation.finished.then(function() {
+      document.documentElement.className = "";
+    });
+  </script>
+</html>
diff --git a/dom/animation/test/crashtests/1216842-3.html b/dom/animation/test/crashtests/1216842-3.html
new file mode 100644
index 0000000000..1bc2179a86
--- /dev/null
+++ b/dom/animation/test/crashtests/1216842-3.html
@@ -0,0 +1,27 @@
+<!doctype html>
+<html class="reftest-wait">
+  <head>
+    <title>Bug 1216842: effect-level easing function produces values greater than 1 (main-thread)</title>
+  </head>
+  <body>
+  <div id="target"></div>
+  </body>
+  <script>
+    var target = document.getElementById("target");
+    var effect =
+      new KeyframeEffect(
+        target,
+        { color: ["red", "blue"] },
+        {
+          fill: "forwards",
+          /* The function produces values greater than 1 in (0.23368794, 1) */
+          easing: "cubic-bezier(0,1.5,1,1.5)",
+          duration: 100
+        }
+      );
+    var animation = new Animation(effect, document.timeline);
+    animation.pause();
+    animation.currentTime = 250;
+    document.documentElement.className = "";
+  </script>
+</html>
diff --git a/dom/animation/test/crashtests/1216842-4.html b/dom/animation/test/crashtests/1216842-4.html
new file mode 100644
index 0000000000..eba13c396a
--- /dev/null
+++ b/dom/animation/test/crashtests/1216842-4.html
@@ -0,0 +1,27 @@
+<!doctype html>
+<html class="reftest-wait">
+  <head>
+    <title>Bug 1216842: effect-level easing function produces negative values (main-thread)</title>
+  </head>
+  <body>
+  <div id="target"></div>
+  </body>
+  <script>
+    var target = document.getElementById("target");
+    var effect =
+      new KeyframeEffect(
+        target,
+        { color: ["red", "blue"] },
+        {
+          fill: "forwards",
+          /* The function produces negative values in (0, 0.766312060) */
+          easing: "cubic-bezier(0,-0.5,1,-0.5)",
+          duration: 100
+        }
+      );
+    var animation = new Animation(effect, document.timeline);
+    animation.pause();
+    animation.currentTime = 250;
+    document.documentElement.className = "";
+  </script>
+</html>
diff --git a/dom/animation/test/crashtests/1216842-5.html b/dom/animation/test/crashtests/1216842-5.html
new file mode 100644
index 0000000000..73b6f22c4b
--- /dev/null
+++ b/dom/animation/test/crashtests/1216842-5.html
@@ -0,0 +1,38 @@
+<!doctype html>
+<html class="reftest-wait">
+  <head>
+    <title>
+      Bug 1216842: effect-level easing function produces negative values passed
+      to step-end function (compositor thread)
+    </title>
+    <style>
+    #target {
+      width: 100px; height: 100px;
+      background: blue;
+    }
+    </style>
+  </head>
+  <body>
+  <div id="target"></div>
+  </body>
+  <script>
+    var target = document.getElementById("target");
+    var effect =
+      new KeyframeEffect(
+        target,
+        { opacity: [0, 1], easing: "step-end" },
+        {
+          fill: "forwards",
+          /* The function produces negative values in (0, 0.766312060) */
+          easing: "cubic-bezier(0,-0.5,1,-0.5)",
+          duration: 100,
+          iterations: 0.75 /* To finish in the extraporation range */
+        }
+      );
+    var animation = new Animation(effect, document.timeline);
+    animation.play();
+    animation.finished.then(function() {
+      document.documentElement.className = "";
+    });
+  </script>
+</html>
diff --git a/dom/animation/test/crashtests/1216842-6.html b/dom/animation/test/crashtests/1216842-6.html
new file mode 100644
index 0000000000..aaf80eeec3
--- /dev/null
+++ b/dom/animation/test/crashtests/1216842-6.html
@@ -0,0 +1,38 @@
+<!doctype html>
+<html class="reftest-wait">
+  <head>
+    <title>
+      Bug 1216842: effect-level easing function produces values greater than 1
+      which are passed to step-end function (compositor thread)
+    </title>
+    <style>
+    #target {
+      width: 100px; height: 100px;
+      background: blue;
+    }
+    </style>
+  </head>
+  <body>
+  <div id="target"></div>
+  </body>
+  <script>
+    var target = document.getElementById("target");
+    var effect =
+      new KeyframeEffect(
+        target,
+        { opacity: [0, 1], easing: "step-end" },
+        {
+          fill: "forwards",
+          /* The function produces values greater than 1 in (0.23368794, 1) */
+          easing: "cubic-bezier(0,1.5,1,1.5)",
+          duration: 100,
+          iterations: 0.25 /* To finish in the extraporation range */
+        }
+      );
+    var animation = new Animation(effect, document.timeline);
+    animation.play();
+    animation.finished.then(function() {
+      document.documentElement.className = "";
+    });
+  </script>
+</html>
diff --git a/dom/animation/test/crashtests/1239889-1.html b/dom/animation/test/crashtests/1239889-1.html
new file mode 100644
index 0000000000..aa10ff3ab8
--- /dev/null
+++ b/dom/animation/test/crashtests/1239889-1.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<html class="reftest-wait">
+  <head>
+    <title>Bug 1239889</title>
+  </head>
+  <body>
+  </body>
+  <script>
+    var div = document.createElement('div');
+    var effect = new KeyframeEffect(div, { opacity: [0, 1] });
+    requestAnimationFrame(() => {
+      document.body.appendChild(div);
+      document.documentElement.classList.remove("reftest-wait");
+    });
+  </script>
+</html>
diff --git a/dom/animation/test/crashtests/1244595-1.html b/dom/animation/test/crashtests/1244595-1.html
new file mode 100644
index 0000000000..13b2e2d7e7
--- /dev/null
+++ b/dom/animation/test/crashtests/1244595-1.html
@@ -0,0 +1,3 @@
+<div id=target><script>
+  var player = target.animate([{background: 'green'}, {background: 'green'}]);
+</script>
diff --git a/dom/animation/test/crashtests/1272475-1.html b/dom/animation/test/crashtests/1272475-1.html
new file mode 100644
index 0000000000..e0b0495388
--- /dev/null
+++ b/dom/animation/test/crashtests/1272475-1.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<html>
+  <head>
+    <title>Bug 1272475 - scale function with an extreme large value</title>
+  <script>
+    function test() {
+      var div = document.createElement("div");
+      div.setAttribute("style", "width: 1px; height: 1px; " +
+                                "background: red;");
+      document.body.appendChild(div);
+      div.animate([ { "transform": "scale(8)" },
+                    { "transform": "scale(9.5e+307)" },
+                    { "transform": "scale(32)" } ],
+                  { "duration": 1000, "fill": "both" });
+    }
+  </script>
+  </head>
+  <body onload="test()">
+  </body>
+</html>
diff --git a/dom/animation/test/crashtests/1272475-2.html b/dom/animation/test/crashtests/1272475-2.html
new file mode 100644
index 0000000000..da0e8605bd
--- /dev/null
+++ b/dom/animation/test/crashtests/1272475-2.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<html>
+  <head>
+    <title>Bug 1272475 - rotate function with an extreme large value</title>
+  <script>
+    function test() {
+      var div = document.createElement("div");
+      div.setAttribute("style", "width: 100px; height: 100px; " +
+                                "background: red;");
+      document.body.appendChild(div);
+      div.animate([ { "transform": "rotate(8rad)" },
+                    { "transform": "rotate(9.5e+307rad)" },
+                    { "transform": "rotate(32rad)" } ],
+                  { "duration": 1000, "fill": "both" });
+    }
+  </script>
+  </head>
+  <body onload="test()">
+  </body>
+</html>
diff --git a/dom/animation/test/crashtests/1277272-1-inner.html b/dom/animation/test/crashtests/1277272-1-inner.html
new file mode 100644
index 0000000000..2565aa6eb8
--- /dev/null
+++ b/dom/animation/test/crashtests/1277272-1-inner.html
@@ -0,0 +1,19 @@
+<!doctype html>
+<head>
+<script>
+function start() {
+  var animation = document.body.animate([{marks: 'crop'},{marks: 'crop'}], 12);
+  document.write('<html><body></body></html>');
+
+  setTimeout(function() { animation.play(); }, 4);
+  setTimeout(function() {
+    animation.timeline = undefined;
+
+    SpecialPowers.Cu.forceGC();
+    window.top.continueTest();
+  }, 5);
+}
+</script>
+</head>
+<body onload="start()"></body>
+</html>
diff --git a/dom/animation/test/crashtests/1277272-1.html b/dom/animation/test/crashtests/1277272-1.html
new file mode 100644
index 0000000000..71b6c24148
--- /dev/null
+++ b/dom/animation/test/crashtests/1277272-1.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<html class="reftest-wait">
+<head>
+<script>
+var count = 0;
+
+function start() {
+  if (++count > 10) {
+    document.documentElement.className = "";
+    return;
+  }
+
+  var frame = document.getElementById("frame");
+  frame.src = "./1277272-1-inner.html";
+}
+
+function continueTest() {
+  setTimeout(start.bind(window), 1);
+}
+
+</script>
+</head>
+<body onload="start()"></body>
+<iframe id="frame">
+</html>
diff --git a/dom/animation/test/crashtests/1278485-1.html b/dom/animation/test/crashtests/1278485-1.html
new file mode 100644
index 0000000000..e7347f5d84
--- /dev/null
+++ b/dom/animation/test/crashtests/1278485-1.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+  document.body.animate([],
+                        { duration: 6,
+                          easing: "cubic-bezier(0, -1e+39, 0, 0)" });
+  document.body.animate([],
+                        { duration: 6,
+                          easing: "cubic-bezier(0, 1e+39, 0, 0)" });
+  document.body.animate([],
+                        { duration: 6,
+                          easing: "cubic-bezier(0, 0, 0, -1e+39)" });
+  document.body.animate([],
+                        { duration: 6,
+                          easing: "cubic-bezier(0, 0, 0, 1e+39)" });
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/animation/test/crashtests/1282691-1.html b/dom/animation/test/crashtests/1282691-1.html
new file mode 100644
index 0000000000..ab6e1a26c0
--- /dev/null
+++ b/dom/animation/test/crashtests/1282691-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html class=reftest-wait>
+<meta charset=utf-8>
+<script>
+
+function boom() {
+  const div = document.createElement('div');
+  const anim = div.animate([{}], {});
+  document.documentElement.appendChild(div);
+  anim.pause();
+  document.documentElement.removeChild(div);
+
+  requestAnimationFrame(() => {
+    document.documentElement.appendChild(div);
+    anim.play();
+    document.documentElement.className = '';
+  });
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/animation/test/crashtests/1291413-1.html b/dom/animation/test/crashtests/1291413-1.html
new file mode 100644
index 0000000000..691a746c6e
--- /dev/null
+++ b/dom/animation/test/crashtests/1291413-1.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<html class=reftest-wait>
+<script>
+window.onload = () => {
+  const div = document.createElement('div');
+
+  document.documentElement.appendChild(div);
+  const anim = div.animate([], 1000);
+
+  anim.ready.then(() => {
+    anim.pause();
+    anim.reverse();
+    anim.playbackRate = 0;
+    anim.ready.then(() => {
+      document.documentElement.className = '';
+    });
+  });
+};
+</script>
+</html>
diff --git a/dom/animation/test/crashtests/1291413-2.html b/dom/animation/test/crashtests/1291413-2.html
new file mode 100644
index 0000000000..fca3a93800
--- /dev/null
+++ b/dom/animation/test/crashtests/1291413-2.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<html class=reftest-wait>
+<script>
+window.onload = () => {
+  const div = document.createElement('div');
+
+  document.documentElement.appendChild(div);
+  const anim = div.animate([], 1000);
+
+  anim.ready.then(() => {
+    anim.pause();
+    anim.reverse();
+    anim.playbackRate = 0;
+    anim.playbackRate = 1;
+    anim.ready.then(() => {
+      document.documentElement.className = '';
+    });
+  });
+};
+</script>
+</html>
diff --git a/dom/animation/test/crashtests/1304886-1.html b/dom/animation/test/crashtests/1304886-1.html
new file mode 100644
index 0000000000..703ef902b9
--- /dev/null
+++ b/dom/animation/test/crashtests/1304886-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<script>
+window.onload=function(){
+  var e = document.createElement("div");
+  document.documentElement.appendChild(e);
+  e.animate([{"font":"status-bar"},
+             {"font":"unset"}],
+            {duration:6,
+             iterationStart:4,
+             iterationComposite:"accumulate"});
+};
+</script>
+</html>
diff --git a/dom/animation/test/crashtests/1309198-1.html b/dom/animation/test/crashtests/1309198-1.html
new file mode 100644
index 0000000000..7fad5782c0
--- /dev/null
+++ b/dom/animation/test/crashtests/1309198-1.html
@@ -0,0 +1,40 @@
+<script>
+function start() {
+  o53=document.createElement('frameset');
+  o254=document.createElement('iframe');
+  o280=document.createElement('audio');
+  o317=document.documentElement;
+  o508=document.createElement('li');
+  o508.appendChild(o317);
+  o590=document.createElement('li');
+  o594=document.createElement('track');
+  o280.appendChild(o594);
+  o647=document.createElement('ol');
+  o654=document.createElement('li');
+  o647.appendChild(o654);
+  o654.insertAdjacentHTML('beforebegin','<iframe>');
+  document.write('<html><body></body></html>');
+  o955=document.documentElement;
+  document.documentElement.appendChild(o647);
+  o590.appendChild(o955);
+  document.close();
+  document.write('<html><body></body></html>');
+  document.documentElement.appendChild(o590);
+  document.documentElement.appendChild(o254);
+  o280.controls^=1;
+  SpecialPowers.forceGC();
+  o317.insertAdjacentHTML('afterend','<iframe>');
+  document.documentElement.appendChild(o280);
+  o2695=document.implementation.createHTMLDocument();
+  o2695.body.appendChild(o254);
+  o53.onerror=f0;
+  document.documentElement.appendChild(o508);
+  o2803=frames[1].document;
+  o2803.getAnimations();
+}
+function f0() {
+  o2803.write('<html><body></body></html>');
+  SpecialPowers.forceCC();
+}
+</script>
+<body onload="start()"></body>
diff --git a/dom/animation/test/crashtests/1322291-1.html b/dom/animation/test/crashtests/1322291-1.html
new file mode 100644
index 0000000000..87def99ba8
--- /dev/null
+++ b/dom/animation/test/crashtests/1322291-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+document.addEventListener("DOMContentLoaded", boom);
+function boom(){
+  let o1 = (function(){
+    let e=document.createElement("frameset");
+    document.documentElement.appendChild(e);
+    return e;
+  })();
+  let a1 = o1.animate({ "transform": "rotate3d(22,73,26,374grad)" },
+                      { duration: 10, delay: 100 });
+
+  // We need to wait the end of the delay to ensure that the animation is
+  // composited on the compositor, but there is no event for script animation
+  // that fires after the delay phase finished. So we wait for finished promise
+  // instead.
+  a1.finished.then(function() {
+    document.documentElement.className = "";
+  });
+}
+</script>
+</body>
+</html>
diff --git a/dom/animation/test/crashtests/1322291-2.html b/dom/animation/test/crashtests/1322291-2.html
new file mode 100644
index 0000000000..b93d53224d
--- /dev/null
+++ b/dom/animation/test/crashtests/1322291-2.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<style>
+div {
+  width: 100px;
+  height: 100px;
+  background-color: red;
+}
+</style>
+<body>
+<div id=o_0></div>
+<script>
+function boom(){
+  var anim = o_0.animate([
+    {},
+    {"transform": "scale(2)"},
+    {"transform": "none"}
+    ], {
+      duration: 100,
+      iterationStart: 0.5,
+    });
+  // We need to wait for finished promise just like we do in 1322291-1.html.
+  anim.finished.then(function() {
+    document.documentElement.classList.remove("reftest-wait");
+  });
+}
+document.addEventListener("DOMContentLoaded", boom);
+</script>
+
+</body>
+</html>
diff --git a/dom/animation/test/crashtests/1322382-1.html b/dom/animation/test/crashtests/1322382-1.html
new file mode 100644
index 0000000000..6ca9c1b836
--- /dev/null
+++ b/dom/animation/test/crashtests/1322382-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<style>
+details {
+  background-color: blue;
+  width: 100px;
+  height: 100px;
+}
+</style>
+<html>
+<details id=o1><div></div></details>
+<script>
+window.onload = function(){
+  o1.animate([{'transform': 'none'}], 100);
+};
+</script>
+</html>
diff --git a/dom/animation/test/crashtests/1323114-1.html b/dom/animation/test/crashtests/1323114-1.html
new file mode 100644
index 0000000000..344fd87db0
--- /dev/null
+++ b/dom/animation/test/crashtests/1323114-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div id=a />
+<script>
+addEventListener("DOMContentLoaded", function(){
+  a.animate([{"transform": "matrix3d(25,8788,-69,-24,-3,85,52,3,63,0,12,36810,-68,15,82,0) rotate(77rad)"}],
+             {fill: "both", iterationStart: 45, iterationComposite: "accumulate"});
+});
+</script>
+</body>
+</html>
diff --git a/dom/animation/test/crashtests/1323114-2.html b/dom/animation/test/crashtests/1323114-2.html
new file mode 100644
index 0000000000..527d05effa
--- /dev/null
+++ b/dom/animation/test/crashtests/1323114-2.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<style>
+div {
+  width: 100px;
+  height: 100px;
+  background-color: blue;
+  transform: rotate(45deg);
+}
+</style>
+<div id="div"></div>
+<script>
+addEventListener('DOMContentLoaded', function (){
+  var target = document.getElementById('div');
+  target.animate([{ transform: 'translateX(100px)', composite: 'accumulate' },
+                  { transform: 'none' }],
+                 1000);
+});
+</script>
diff --git a/dom/animation/test/crashtests/1323119-1.html b/dom/animation/test/crashtests/1323119-1.html
new file mode 100644
index 0000000000..fd979822b8
--- /dev/null
+++ b/dom/animation/test/crashtests/1323119-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<body>
+<script>
+addEventListener("DOMContentLoaded", function() {
+  let a = document.createElement("th");
+  document.documentElement.appendChild(a);
+  a.animate([{"mask": "repeat-y "}], 484);
+  document.documentElement.classList.remove("reftest-wait");
+});
+</script>
+</body>
+</html>
diff --git a/dom/animation/test/crashtests/1324554-1.html b/dom/animation/test/crashtests/1324554-1.html
new file mode 100644
index 0000000000..b3f9435a18
--- /dev/null
+++ b/dom/animation/test/crashtests/1324554-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+  <head>
+  <meta charset="UTF-8">
+  <title>Bug 1324554 - missing final keyframes and zero-length segments together</title>
+  </head>
+  <script>
+    function go() {
+      var div = document.getElementById('target');
+      div.animate([ { "flex": "none" },
+                    { "flex": "initial", offset: 0.5 },
+                    { "flex": "0.0 ", offset: 0.5 },
+                    {} ]);
+    }
+  </script>
+  <body onload="go()">
+    <div id='target' ></div>
+  </body>
+</html>
diff --git a/dom/animation/test/crashtests/1325193-1.html b/dom/animation/test/crashtests/1325193-1.html
new file mode 100644
index 0000000000..bd0666497c
--- /dev/null
+++ b/dom/animation/test/crashtests/1325193-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<meta charset="UTF-8">
+<script>
+function boom(){
+  o_0.animate([{"perspective": "262ex"}, {}], {duration: 1070, iterationStart: 68, iterationComposite: "accumulate"});
+  o_0.animate([{"color": "white", "flex": "inherit"}, {"color": "red", "flex": "66% "}], 3439);
+  o_0.animate([{"font": "icon"}], 1849);
+  setTimeout(function() {
+    document.documentElement.classList.remove("reftest-wait");
+  }, 500);
+}
+document.addEventListener("DOMContentLoaded", boom);
+</script>
+</head>
+<body><details id=o_0><q></q></details></body>
+</html>
diff --git a/dom/animation/test/crashtests/1330190-1.html b/dom/animation/test/crashtests/1330190-1.html
new file mode 100644
index 0000000000..fa14e0f741
--- /dev/null
+++ b/dom/animation/test/crashtests/1330190-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<span id=a />
+<script>
+addEventListener("DOMContentLoaded", function(){
+  a.animate([{"left": "38%"}], 100);
+  a.appendChild(document.createElement("div"));
+  document.documentElement.classList.remove("reftest-wait");
+});
+</script>
+</html>
diff --git a/dom/animation/test/crashtests/1330190-2.html b/dom/animation/test/crashtests/1330190-2.html
new file mode 100644
index 0000000000..57e5d31b28
--- /dev/null
+++ b/dom/animation/test/crashtests/1330190-2.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<style>
+@keyframes anim {
+}
+
+#o_0:before {
+  animation: anim 10s;
+  content: "";
+}
+</style>
+<meta charset="UTF-8">
+<script>
+function boom(){
+  function getPseudoElement() {
+    var anim = document.getAnimations()[0];
+    anim.cancel();
+    return anim.effect.target;
+  }
+
+  var target = getPseudoElement();
+  target.animate([{"perspective": "262ex"}, {}], {duration: 1070, iterationStart: 68, iterationComposite: "accumulate"});
+  target.animate([{"color": "white", "flex": "inherit"}, {"color": "red", "flex": "66% "}], 3439);
+  target.animate([{"font": "icon"}], 1849);
+  setTimeout(function() {
+    document.documentElement.classList.remove("reftest-wait");
+  }, 500);
+}
+document.addEventListener("DOMContentLoaded", boom);
+</script>
+</head>
+<body>
+<div id=o_0></div>
+</body>
+</html>
diff --git a/dom/animation/test/crashtests/1330513-1.html b/dom/animation/test/crashtests/1330513-1.html
new file mode 100644
index 0000000000..a497cc9e27
--- /dev/null
+++ b/dom/animation/test/crashtests/1330513-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<body id=a></body>
+<script>
+document.getElementById("a")
+  .animate([{"filter": "grayscale(28%)"}], {fill:"forwards", composite:"add"});
+</script>
+</html>
diff --git a/dom/animation/test/crashtests/1332588-1.html b/dom/animation/test/crashtests/1332588-1.html
new file mode 100644
index 0000000000..11719a86ca
--- /dev/null
+++ b/dom/animation/test/crashtests/1332588-1.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<meta charset="UTF-8">
+<style>
+span {
+  width: 100px;
+  height: 100px;
+  background-color: red;
+}
+</style>
+<script>
+window.onload = function() {
+  let body = document.getElementsByTagName("body")[0];
+  let o_0 = document.createElement("span");
+  body.appendChild(o_0);
+  o_0.animate([{ "padding": "57pt", "transform": "none" },
+               { "padding": "57pt", "transform": "rotate(90deg)" }] , 10000);
+  body.appendChild(document.createElement("colgroup"));
+  document.documentElement.classList.remove("reftest-wait");
+};
+</script>
+</head>
+<body></body>
+</html>
diff --git a/dom/animation/test/crashtests/1333539-1.html b/dom/animation/test/crashtests/1333539-1.html
new file mode 100644
index 0000000000..c9111890b0
--- /dev/null
+++ b/dom/animation/test/crashtests/1333539-1.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<meta charset="UTF-8">
+<script>
+window.onload = function(){
+  let body = document.getElementsByTagName("body")[0];
+  let target = document.createElement("div");
+  let anim1 = new Animation();
+  let anim2 = new Animation();
+  let effect = new KeyframeEffect(target, { opacity: [ 0, 1 ] }, 1000);
+  body.appendChild(target);
+  target.appendChild(document.createElement("meter"));
+  anim1.startTime = 88;
+  anim1.timeline = null;
+  anim1.pause();
+  anim1.effect = effect;
+  anim2.effect = effect;
+  anim1.effect = effect;
+
+  // anim1, since it doesn't have a timeline, will remain pause-pending,
+  // so just wait on anim2.
+  anim2.ready.then(() => {
+    document.documentElement.classList.remove("reftest-wait");
+  });
+};
+</script>
+</head>
+<body></body>
+</html>
diff --git a/dom/animation/test/crashtests/1333539-2.html b/dom/animation/test/crashtests/1333539-2.html
new file mode 100644
index 0000000000..b00700eccb
--- /dev/null
+++ b/dom/animation/test/crashtests/1333539-2.html
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<style>
+div {
+  width: 100px;
+  height: 100px;
+  background-color: blue;
+}
+</style>
+<script>
+window.onload = function(){
+  let body = document.getElementsByTagName("body")[0];
+  let target = document.createElement("div");
+  let anim1 = new Animation();
+  let anim2 = new Animation();
+  let effect = new KeyframeEffect(target, { opacity: [ 0, 1 ] }, 1000);
+  body.appendChild(target);
+  anim1.startTime = 88;
+  anim1.timeline = null;
+  anim1.pause();
+  anim1.effect = effect;
+  anim2.effect = effect;
+  anim1.effect = effect;
+  // Put another opacity animation on the top of the effect stack so that we
+  // try to send a lower priority animation that has no timeline to the
+  // compositor.
+  let anim3 = target.animate({ opacity : [ 1, 0 ] }, 1000);
+
+  Promise.all([anim1.ready, anim2.ready, anim2.ready]).then(function() {
+    document.documentElement.classList.remove("reftest-wait");
+  });
+};
+</script>
+</head>
+<body></body>
+</html>
diff --git a/dom/animation/test/crashtests/1334582-1.html b/dom/animation/test/crashtests/1334582-1.html
new file mode 100644
index 0000000000..d67ddc3c52
--- /dev/null
+++ b/dom/animation/test/crashtests/1334582-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+window.onload = function(){
+  let a = document.documentElement.animate([], {"iterations": 1.7976931348623157e+308, "fill": "both"});
+};
+</script>
+</head>
+</html>
diff --git a/dom/animation/test/crashtests/1334582-2.html b/dom/animation/test/crashtests/1334582-2.html
new file mode 100644
index 0000000000..d3b223650d
--- /dev/null
+++ b/dom/animation/test/crashtests/1334582-2.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+window.onload = function(){
+  let a = document.documentElement.animate([], {"iterationStart": 1.7976931348623157e+308, "fill": "both"});
+};
+</script>
+</head>
+</html>
diff --git a/dom/animation/test/crashtests/1334583-1.html b/dom/animation/test/crashtests/1334583-1.html
new file mode 100644
index 0000000000..b4d4109f0d
--- /dev/null
+++ b/dom/animation/test/crashtests/1334583-1.html
@@ -0,0 +1,9 @@
+<div style="width: 200px; height: 200px; background: purple" id=div>
+</div>
+<script>
+const animation = div.animate(
+  [ { transform: "scale(1)" },
+    { transform: "scale(2)" } ],
+    { iterations: Infinity, duration: 512 } );
+animation.currentTime = 2147483647;
+</script>
diff --git a/dom/animation/test/crashtests/1335998-1.html b/dom/animation/test/crashtests/1335998-1.html
new file mode 100644
index 0000000000..72353a9692
--- /dev/null
+++ b/dom/animation/test/crashtests/1335998-1.html
@@ -0,0 +1,28 @@
+<!doctype html>
+<html class="reftest-wait">
+  <head>
+    <title>
+      Bug 1335998 - Handle {Interpolate, Accumulate}Matrix of mismatched transform lists
+    </title>
+    <style>
+    #target {
+      width: 100px; height: 100px;
+      background: blue;
+      transform: rotate(45deg);
+    }
+    </style>
+  </head>
+  <body>
+  <div id="target"></div>
+  </body>
+  <script>
+    var div = document.getElementById("target");
+    var animation = div.animate([ { transform: 'translateX(200px) scale(2.0)',
+                                    composite: 'accumulate' },
+                                  { transform: 'rotate(-45deg)' } ],
+                                2000);
+    animation.finished.then(function() {
+      document.documentElement.className = "";
+    });
+  </script>
+</html>
diff --git a/dom/animation/test/crashtests/1343589-1.html b/dom/animation/test/crashtests/1343589-1.html
new file mode 100644
index 0000000000..a494b83da3
--- /dev/null
+++ b/dom/animation/test/crashtests/1343589-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<meta charset="UTF-8">
+<script>
+window.onload = function(){
+  let a = document.documentElement.animate(null,
+            { duration: 100, iterations: Number.POSITIVE_INFINITY });
+  a.startTime = 100000; // Set the start time far in the future
+  // Try reversing (this should throw because the target effect end is infinity)
+  try { a.reverse(); } catch(e) {}
+  // Do something that will trigger a timing update
+  a.effect.target = document.createElement("span");
+  document.documentElement.className = '';
+};
+</script>
+</head>
+</html>
diff --git a/dom/animation/test/crashtests/1359658-1.html b/dom/animation/test/crashtests/1359658-1.html
new file mode 100644
index 0000000000..972ec497fa
--- /dev/null
+++ b/dom/animation/test/crashtests/1359658-1.html
@@ -0,0 +1,33 @@
+<!doctype html>
+<html class="reftest-wait">
+  <head>
+    <meta charset=utf-8>
+    <title>Bug 1359658: Animation-only dirty descendants bit should be cleared
+           for display:none content</title>
+  </head>
+  <body>
+  <div id="ancestor">
+    <svg>
+      <rect id="target" width="100%" height="100%" fill="lime"/>
+    </svg>
+  </div>
+  </body>
+  <script>
+'use strict';
+
+const ancestor = document.getElementById('ancestor');
+const target   = document.getElementById('target');
+
+document.addEventListener('DOMContentLoaded', () => {
+  const animation = target.animate({ color: [ 'red', 'lime' ] },
+                                   { duration: 1000, iterations: Infinity });
+  requestAnimationFrame(() => {
+    // Tweak animation to cause animation dirty bit to be set
+    animation.effect.updateTiming({ duration: 2000 });
+    ancestor.style.display = "none";
+    getComputedStyle(ancestor).display;
+    document.documentElement.className = '';
+  });
+});
+  </script>
+</html>
diff --git a/dom/animation/test/crashtests/1373712-1.html b/dom/animation/test/crashtests/1373712-1.html
new file mode 100644
index 0000000000..8b5c121c85
--- /dev/null
+++ b/dom/animation/test/crashtests/1373712-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Bug 1373712 - Assertions of SpecifiedKeyframeArraysAreEqual(mKeyframes, keyframesCopy) with large color value
+</title>
+<meta charset="UTF-8">
+<script>
+document.documentElement.animate([{ "color": "hsl(63e292,41%,34%)" }]);
+</script>
+</head>
+</html>
diff --git a/dom/animation/test/crashtests/1379606-1.html b/dom/animation/test/crashtests/1379606-1.html
new file mode 100644
index 0000000000..89f756bf06
--- /dev/null
+++ b/dom/animation/test/crashtests/1379606-1.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<style>
+div {
+  display: none;
+}
+</style>
+<div>
+<div>
+<div>
+<div>
+<div>
+<div id="target">
+</div>
+</div>
+</div>
+</div>
+</div>
+</div>
+<script>
+  target.animate({ color: "red" })
+</script>
diff --git a/dom/animation/test/crashtests/1393605-1.html b/dom/animation/test/crashtests/1393605-1.html
new file mode 100644
index 0000000000..9f282e58ba
--- /dev/null
+++ b/dom/animation/test/crashtests/1393605-1.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<html>
+  <head>
+    <title>
+      Bug 1393605 - Still work if determinant of 2d matrix is not 1 or -1
+    </title>
+  </head>
+  <script>
+    document.documentElement.animate(
+      [ { 'transform': 'scale(4)' },
+        { 'transform': 'rotate(3grad) scaleX(0) ' +
+                       'translate(2mm) matrix(2,7,1,.32,7,0)' } ],
+      { fill: 'both' });
+  </script>
+</html>
diff --git a/dom/animation/test/crashtests/1400022-1.html b/dom/animation/test/crashtests/1400022-1.html
new file mode 100644
index 0000000000..8256091e1e
--- /dev/null
+++ b/dom/animation/test/crashtests/1400022-1.html
@@ -0,0 +1,10 @@
+<script>
+requestIdleCallback(function(){ location.reload() })
+a = document.createElement("x")
+document.documentElement.appendChild(a)
+b = document.createElement('link')
+b.setAttribute('rel', 'stylesheet')
+b.setAttribute('href', 'data:,*{border-block-start:solid}')
+document.head.appendChild(b)
+a.insertAdjacentHTML("afterBegin", "<d id='id0' style='transition-duration:1s'><svg filter='url(#id0)'>")
+</script>
diff --git a/dom/animation/test/crashtests/1401809.html b/dom/animation/test/crashtests/1401809.html
new file mode 100644
index 0000000000..7a3adcc60c
--- /dev/null
+++ b/dom/animation/test/crashtests/1401809.html
@@ -0,0 +1,14 @@
+<html>
+  <head>
+    <style></style>
+    <script>
+      o1 = document.createElement('t');
+      document.documentElement.appendChild(o1);
+      document.styleSheets[0].insertRule('* { will-change:an }', 0);
+      k = new KeyframeEffect(o1, [{'willChange':'s'}], {'':''});
+      k = null;
+      SpecialPowers.forceGC();
+      SpecialPowers.forceCC();
+    </script>
+  </head>
+</html>
diff --git a/dom/animation/test/crashtests/1411318-1.html b/dom/animation/test/crashtests/1411318-1.html
new file mode 100644
index 0000000000..5c8e7211c1
--- /dev/null
+++ b/dom/animation/test/crashtests/1411318-1.html
@@ -0,0 +1,15 @@
+<html>
+  <head>
+    <script>
+      o1 = (new DOMParser).parseFromString('', 'text/html');
+      o2 = document.createElement('canvas');
+      document.documentElement.appendChild(o2);
+      o3 = o2.animate([{'transform':'unset'}], {'delay':32});
+      o4 = o3.effect;
+      o5 = o1.createElement('d');
+      o6 = new Animation(o4, document.timeline);
+      o7 = o5.animate([], {});
+      o7.effect = o6.effect;
+    </script>
+  </head>
+</html>
diff --git a/dom/animation/test/crashtests/1467277-1.html b/dom/animation/test/crashtests/1467277-1.html
new file mode 100644
index 0000000000..c58fc64493
--- /dev/null
+++ b/dom/animation/test/crashtests/1467277-1.html
@@ -0,0 +1,6 @@
+<script>
+addEventListener("DOMContentLoaded", () => {
+  document.documentElement.animate(
+    [ { "transform": "rotate3d(1e58, 2, 6, 0turn)" } ], 1000)
+})
+</script>
diff --git a/dom/animation/test/crashtests/1468294-1.html b/dom/animation/test/crashtests/1468294-1.html
new file mode 100644
index 0000000000..e4092046ac
--- /dev/null
+++ b/dom/animation/test/crashtests/1468294-1.html
@@ -0,0 +1,7 @@
+<script>
+addEventListener("DOMContentLoaded", () => {
+  document.documentElement.animate([{ "transform": "matrix(2,1,1,5,2,8)" }],
+                                    { duration: 1000,
+                                      easing: "cubic-bezier(1,-15,.6,4)" });
+})
+</script>
diff --git a/dom/animation/test/crashtests/1524480-1.html b/dom/animation/test/crashtests/1524480-1.html
new file mode 100644
index 0000000000..89e5a412d9
--- /dev/null
+++ b/dom/animation/test/crashtests/1524480-1.html
@@ -0,0 +1,37 @@
+<!doctype html>
+<html class="reftest-wait">
+<meta charset=utf-8>
+<style>
+div {
+  display: none;
+  width: 100px;
+  height: 100px;
+  background: blue;
+}
+</style>
+<div id=div></div>
+<script>
+async function test() {
+  const animation = div.animate({ transform: ['none', 'none'] }, 1000);
+  animation.cancel();
+
+  await waitForFrame();
+
+  div.style.display = 'block';
+
+  await waitForFrame();
+  await waitForFrame();
+
+  animation.play();
+  await animation.finished;
+
+  document.documentElement.className = "";
+}
+
+function waitForFrame() {
+  return new Promise(resolve => requestAnimationFrame(resolve));
+}
+
+test();
+</script>
+</html>
diff --git a/dom/animation/test/crashtests/1575926.html b/dom/animation/test/crashtests/1575926.html
new file mode 100644
index 0000000000..cc37c94235
--- /dev/null
+++ b/dom/animation/test/crashtests/1575926.html
@@ -0,0 +1,24 @@
+<style>
+    @keyframes animation_0 {
+        88% { }
+    }
+
+    * {
+        animation-name: animation_0;
+        animation-delay: 4s;
+    }
+</style>
+<script>
+  function start () {
+    const input = document.createElement('input')
+    document.documentElement.appendChild(input)
+    const animations = input.getAnimations({})
+    const animation = animations[(3782796448 % animations.length)]
+    const effect = animation.effect
+    effect.setKeyframes({ 'borderLeft': ['inherit'] })
+    effect.target = null
+    input.contentEditable = 'true'
+  }
+
+  document.addEventListener('DOMContentLoaded', start)
+</script>
diff --git a/dom/animation/test/crashtests/1585770.html b/dom/animation/test/crashtests/1585770.html
new file mode 100644
index 0000000000..018d688582
--- /dev/null
+++ b/dom/animation/test/crashtests/1585770.html
@@ -0,0 +1,22 @@
+<html class="reftest-wait">
+<script>
+function start () {
+  const kf_effect =
+      new KeyframeEffect(document.documentElement,
+                         { opacity: ['', '1'] },
+                         { easing: 'step-end',
+                           duration: 10000 } );
+  const copy = new KeyframeEffect(kf_effect);
+  const animation = new Animation(copy);
+
+  animation.reverse();
+  document.documentElement.getBoundingClientRect();
+
+  requestAnimationFrame(() => {
+    document.documentElement.classList.remove("reftest-wait");
+  });
+}
+
+document.addEventListener('DOMContentLoaded', start);
+</script>
+</html>
diff --git a/dom/animation/test/crashtests/1604500-1.html b/dom/animation/test/crashtests/1604500-1.html
new file mode 100644
index 0000000000..01a6eafd1f
--- /dev/null
+++ b/dom/animation/test/crashtests/1604500-1.html
@@ -0,0 +1,24 @@
+<!doctype html>
+<html>
+<head>
+<script>
+function start () {
+  const keyframe = new KeyframeEffect(undefined, {});
+  const animation = new Animation(keyframe, undefined);
+  // Make animation run backwards...
+  animation.playbackRate = -100;
+  // But then set the current time to the future so it becomes "current"...
+  animation.currentTime = 2055;
+  // After updating the playback rate to zero, however, it should no longer
+  // be "current" (and this takes effect immediately because |animation| is
+  // paused)...
+  animation.updatePlaybackRate(0);
+  // Now update the target and hope nothing goes wrong...
+  keyframe.target = div;
+}
+
+document.addEventListener('DOMContentLoaded', start)
+</script>
+</head>
+<div id=div></div>
+</html>
diff --git a/dom/animation/test/crashtests/1611847.html b/dom/animation/test/crashtests/1611847.html
new file mode 100644
index 0000000000..720ce1179b
--- /dev/null
+++ b/dom/animation/test/crashtests/1611847.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+  <style>
+    * {
+      transition-duration: 2s;
+    }
+  </style>
+  <script>
+    function start () {
+      const element = document.createElementNS('', 's');
+      const effect = new KeyframeEffect(document.documentElement, {}, 196);
+      document.documentElement.setAttribute('style', 'padding-left:3');
+      effect.updateTiming({ 'delay': 2723 });
+      const animations = document.getAnimations();
+      animations[0].effect = effect;
+      animations[0].updatePlaybackRate(-129);
+      effect.target = element;
+    }
+
+    document.addEventListener('DOMContentLoaded', start);
+  </script>
+</head>
+</html>
diff --git a/dom/animation/test/crashtests/1612891-1.html b/dom/animation/test/crashtests/1612891-1.html
new file mode 100644
index 0000000000..44cf022e88
--- /dev/null
+++ b/dom/animation/test/crashtests/1612891-1.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+  <script>
+    function start() {
+      const element = document.createElement('img')
+      element.animate([
+        { 'easing': '' },
+        { 'offset': 'o' },
+      ], {})
+    }
+
+    window.addEventListener('load', start)
+  </script>
+</head>
+</html>
diff --git a/dom/animation/test/crashtests/1612891-2.html b/dom/animation/test/crashtests/1612891-2.html
new file mode 100644
index 0000000000..a9779ba70f
--- /dev/null
+++ b/dom/animation/test/crashtests/1612891-2.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+  <script>
+    function start() {
+      const element = document.createElement('img')
+      element.animate([
+        { 'easing': '' },
+        123,
+      ], {})
+    }
+
+    window.addEventListener('load', start)
+  </script>
+</head>
+</html>
diff --git a/dom/animation/test/crashtests/1612891-3.html b/dom/animation/test/crashtests/1612891-3.html
new file mode 100644
index 0000000000..89e71b6ca8
--- /dev/null
+++ b/dom/animation/test/crashtests/1612891-3.html
@@ -0,0 +1,10 @@
+<html>
+<head>
+  <script>
+    document.addEventListener('DOMContentLoaded', () => {
+      const keyframe = new KeyframeEffect(document.documentElement, [{}], {})
+      keyframe.setKeyframes([{ 'easing': '' }, { 'offset': 'o', }])
+    })
+  </script>
+</head>
+</html>
diff --git a/dom/animation/test/crashtests/1633442.html b/dom/animation/test/crashtests/1633442.html
new file mode 100644
index 0000000000..cb4beedebc
--- /dev/null
+++ b/dom/animation/test/crashtests/1633442.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<html class="reftest-wait">
+<head>
+<script>
+  document.addEventListener('DOMContentLoaded', () => {
+    document.documentElement.style.setProperty('transition-duration', '3s', '')
+    document.documentElement.style.setProperty('rotate', '2deg', undefined)
+    document.documentElement.style.setProperty('border-radius', '2%', '')
+    const [anim_1, anim_0] = document.documentElement.getAnimations({})
+    anim_1.effect = anim_0.effect
+    document.documentElement.classList.remove("reftest-wait");
+  })
+</script>
+</head>
+</html>
diff --git a/dom/animation/test/crashtests/1633486.html b/dom/animation/test/crashtests/1633486.html
new file mode 100644
index 0000000000..20b88f6327
--- /dev/null
+++ b/dom/animation/test/crashtests/1633486.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<html>
+<head>
+  <script>
+    window.addEventListener('load', async () => {
+      const element = document.getElementById('target');
+      element.animate({
+        'all': ['initial']
+      }, {
+        'duration': 500,
+        'pseudoElement': '::marker',
+      })
+      element.hidden = false;
+    })
+  </script>
+</head>
+<ul>
+  <li id='target' hidden></li>
+</ul>
+</html>
diff --git a/dom/animation/test/crashtests/1656419.html b/dom/animation/test/crashtests/1656419.html
new file mode 100644
index 0000000000..4e76cb0a55
--- /dev/null
+++ b/dom/animation/test/crashtests/1656419.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<style>
+#target {
+  width: 200vw;
+  height: 200vh;
+}
+</style>
+<div id="target"></div>
+<script>
+const animA = target.animate(
+  { transform: 'translateX(100px)' },
+  { duration: 50 }
+);
+const animB = target.animate(
+  { transform: 'translateX(100px)', composite: 'add' },
+  { duration: 100 }
+);
+animB.finished.then(() => {
+  document.documentElement.classList.remove("reftest-wait");
+});
+</script>
+</html>
diff --git a/dom/animation/test/crashtests/1699890.html b/dom/animation/test/crashtests/1699890.html
new file mode 100644
index 0000000000..95aa1e190c
--- /dev/null
+++ b/dom/animation/test/crashtests/1699890.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<style>
+@keyframes anim {
+  from { background-color: rgba(0, 0, 0, 0); }
+  to { background-color: rgba(255, 0, 0, 255); }
+}
+body {
+  animation: anim 100s;
+  width: 100vw;
+  height: 100vh;
+}
+</style>
diff --git a/dom/animation/test/crashtests/1706157.html b/dom/animation/test/crashtests/1706157.html
new file mode 100644
index 0000000000..cfa7b70b56
--- /dev/null
+++ b/dom/animation/test/crashtests/1706157.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <style>
+        @keyframes animation {
+            to {
+                left: 100px;
+            }
+        }
+        * {
+            animation: animation linear 1s;
+        }
+        #target {
+            animation-timing-function: steps(2965566999, jump-both);
+        }
+    </style>
+</head>
+<div id="target"></div>
+</html>
diff --git a/dom/animation/test/crashtests/1714421.html b/dom/animation/test/crashtests/1714421.html
new file mode 100644
index 0000000000..04099b55b7
--- /dev/null
+++ b/dom/animation/test/crashtests/1714421.html
@@ -0,0 +1,8 @@
+<script>
+document.addEventListener('DOMContentLoaded', () => {
+  document.documentElement.style.setProperty('scale', '89%', undefined)
+  document.documentElement.style.setProperty('-moz-transition-duration', '2009216159ms', '')
+  document.getAnimations()[0].timeline = undefined
+  document.documentElement.animate({'scale': ['none', 'none', 'none']}, 1807)
+})
+</script>
diff --git a/dom/animation/test/crashtests/1807966.html b/dom/animation/test/crashtests/1807966.html
new file mode 100644
index 0000000000..d2759d2b5c
--- /dev/null
+++ b/dom/animation/test/crashtests/1807966.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<style>
+  #target {
+    transition-timing-function: linear(calc(15 / 0), 10 10%);
+    transition-duration: 10s;
+  }
+</style>
+<script>
+  window.addEventListener('load', () => {
+    target.style.paddingBlock = "10px 10px";
+  })
+</script>
+<slot id="target"></slot>
diff --git a/dom/animation/test/crashtests/crashtests.list b/dom/animation/test/crashtests/crashtests.list
new file mode 100644
index 0000000000..6f5dd140e7
--- /dev/null
+++ b/dom/animation/test/crashtests/crashtests.list
@@ -0,0 +1,61 @@
+load 1134538.html
+pref(dom.animations-api.core.enabled,true) load 1239889-1.html
+load 1244595-1.html
+pref(dom.animations-api.core.enabled,true) pref(dom.animations-api.timelines.enabled,true) load 1216842-1.html
+pref(dom.animations-api.core.enabled,true) pref(dom.animations-api.timelines.enabled,true) load 1216842-2.html
+pref(dom.animations-api.core.enabled,true) pref(dom.animations-api.timelines.enabled,true) load 1216842-3.html
+pref(dom.animations-api.core.enabled,true) pref(dom.animations-api.timelines.enabled,true) load 1216842-4.html
+pref(dom.animations-api.core.enabled,true) pref(dom.animations-api.timelines.enabled,true) load 1216842-5.html
+pref(dom.animations-api.core.enabled,true) pref(dom.animations-api.timelines.enabled,true) load 1216842-6.html
+load 1272475-1.html
+load 1272475-2.html
+load 1278485-1.html
+pref(dom.animations-api.timelines.enabled,true) load 1277272-1.html
+load 1282691-1.html
+pref(dom.animations-api.core.enabled,true) load 1291413-1.html
+pref(dom.animations-api.core.enabled,true) load 1291413-2.html
+pref(dom.animations-api.compositing.enabled,true) load 1304886-1.html
+pref(dom.animations-api.getAnimations.enabled,true) load 1309198-1.html
+pref(dom.animations-api.implicit-keyframes.enabled,true) load 1322382-1.html
+pref(dom.animations-api.core.enabled,true) pref(dom.animations-api.implicit-keyframes.enabled,true) load 1322291-1.html
+pref(dom.animations-api.core.enabled,true) pref(dom.animations-api.implicit-keyframes.enabled,true) load 1322291-2.html
+pref(dom.animations-api.implicit-keyframes.enabled,true) pref(dom.animations-api.compositing.enabled,true) load 1323114-1.html
+pref(dom.animations-api.compositing.enabled,true) load 1323114-2.html
+pref(dom.animations-api.implicit-keyframes.enabled,true) load 1323119-1.html
+pref(dom.animations-api.implicit-keyframes.enabled,true) load 1324554-1.html
+pref(dom.animations-api.implicit-keyframes.enabled,true) pref(dom.animations-api.compositing.enabled,true) load 1325193-1.html
+load 1332588-1.html
+pref(dom.animations-api.implicit-keyframes.enabled,true) load 1330190-1.html
+pref(dom.animations-api.core.enabled,true) pref(dom.animations-api.implicit-keyframes.enabled,true) pref(dom.animations-api.compositing.enabled,true) pref(dom.animations-api.getAnimations.enabled,true) load 1330190-2.html
+pref(dom.animations-api.implicit-keyframes.enabled,true) pref(dom.animations-api.compositing.enabled,true) load 1330513-1.html
+pref(dom.animations-api.core.enabled,true) pref(dom.animations-api.timelines.enabled,true) load 1333539-1.html
+pref(dom.animations-api.core.enabled,true) pref(dom.animations-api.timelines.enabled,true) load 1333539-2.html
+load 1334582-1.html
+load 1334582-2.html
+load 1334583-1.html
+pref(dom.animations-api.core.enabled,true) pref(dom.animations-api.compositing.enabled,true) load 1335998-1.html
+pref(dom.animations-api.core.enabled,true) load 1343589-1.html
+pref(dom.animations-api.core.enabled,true) load 1359658-1.html
+pref(dom.animations-api.implicit-keyframes.enabled,true) load 1373712-1.html
+pref(dom.animations-api.implicit-keyframes.enabled,true) load 1379606-1.html
+load 1393605-1.html
+load 1400022-1.html
+pref(dom.animations-api.core.enabled,true) pref(dom.animations-api.implicit-keyframes.enabled,true) load 1401809.html
+pref(dom.animations-api.core.enabled,true) pref(dom.animations-api.timelines.enabled,true) pref(dom.animations-api.implicit-keyframes.enabled,true) load 1411318-1.html
+pref(dom.animations-api.implicit-keyframes.enabled,true) load 1468294-1.html
+pref(dom.animations-api.implicit-keyframes.enabled,true) load 1467277-1.html
+load 1524480-1.html
+load 1575926.html
+pref(dom.animations-api.implicit-keyframes.enabled,true) load 1585770.html
+load 1604500-1.html
+pref(dom.animations-api.core.enabled,true) pref(dom.animations-api.getAnimations.enabled,true) load 1611847.html
+pref(dom.animations-api.core.enabled,true) load 1612891-1.html
+pref(dom.animations-api.core.enabled,true) load 1612891-2.html
+pref(dom.animations-api.core.enabled,true) load 1612891-3.html
+pref(dom.animations-api.core.enabled,true) pref(dom.animations-api.getAnimations.enabled,true) load 1633442.html
+pref(dom.animations-api.core.enabled,true) pref(dom.animations-api.implicit-keyframes.enabled,true) load 1633486.html
+pref(layout.animation.prerender.partial,true) load 1656419.html
+pref(layout.css.step-position-jump.enabled,true) load 1706157.html
+pref(gfx.omta.background-color,true) load 1699890.html
+pref(dom.animations-api.core.enabled,true) pref(dom.animations-api.getAnimations.enabled,true) pref(dom.animations-api.timelines.enabled,true) load 1714421.html
+pref(layout.css.linear-easing-function.enabled,true) load 1807966.html
-- 
cgit v1.2.3