From 36d22d82aa202bb199967e9512281e9a53db42c9 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Sun, 7 Apr 2024 21:33:14 +0200
Subject: Adding upstream version 115.7.0esr.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 dom/media/tests/crashtests/1281695.html         | 24 +++++++++
 dom/media/tests/crashtests/1306476.html         | 47 +++++++++++++++++
 dom/media/tests/crashtests/1348381.html         | 22 ++++++++
 dom/media/tests/crashtests/1367930_1.html       | 39 ++++++++++++++
 dom/media/tests/crashtests/1367930_2.html       | 25 +++++++++
 dom/media/tests/crashtests/1429507_1.html       | 13 +++++
 dom/media/tests/crashtests/1429507_2.html       | 15 ++++++
 dom/media/tests/crashtests/1443212.html         | 13 +++++
 dom/media/tests/crashtests/1453030.html         | 19 +++++++
 dom/media/tests/crashtests/1468451.html         | 10 ++++
 dom/media/tests/crashtests/1490700.html         | 28 ++++++++++
 dom/media/tests/crashtests/1505957.html         | 23 ++++++++
 dom/media/tests/crashtests/1509442-1.html       | 14 +++++
 dom/media/tests/crashtests/1509442.html         |  7 +++
 dom/media/tests/crashtests/1510848.html         |  4 ++
 dom/media/tests/crashtests/1511130.html         | 12 +++++
 dom/media/tests/crashtests/1516292.html         | 16 ++++++
 dom/media/tests/crashtests/1573536.html         | 18 +++++++
 dom/media/tests/crashtests/1576938.html         | 16 ++++++
 dom/media/tests/crashtests/1594136.html         | 15 ++++++
 dom/media/tests/crashtests/1749308.html         | 18 +++++++
 dom/media/tests/crashtests/1764915.html         | 14 +++++
 dom/media/tests/crashtests/1764933.html         | 15 ++++++
 dom/media/tests/crashtests/1764940.html         | 14 +++++
 dom/media/tests/crashtests/1766668.html         | 11 ++++
 dom/media/tests/crashtests/1783765.html         | 22 ++++++++
 dom/media/tests/crashtests/780790.html          | 16 ++++++
 dom/media/tests/crashtests/791270.html          | 17 ++++++
 dom/media/tests/crashtests/791278.html          | 20 +++++++
 dom/media/tests/crashtests/791330.html          | 35 +++++++++++++
 dom/media/tests/crashtests/799419.html          | 32 +++++++++++
 dom/media/tests/crashtests/801227.html          | 35 +++++++++++++
 dom/media/tests/crashtests/802982.html          | 27 ++++++++++
 dom/media/tests/crashtests/812785.html          | 70 +++++++++++++++++++++++++
 dom/media/tests/crashtests/822197.html          | 28 ++++++++++
 dom/media/tests/crashtests/834100.html          | 25 +++++++++
 dom/media/tests/crashtests/836349.html          | 20 +++++++
 dom/media/tests/crashtests/837324.html          | 25 +++++++++
 dom/media/tests/crashtests/855796.html          | 66 +++++++++++++++++++++++
 dom/media/tests/crashtests/860143.html          | 25 +++++++++
 dom/media/tests/crashtests/861958.html          | 24 +++++++++
 dom/media/tests/crashtests/863929.html          | 66 +++++++++++++++++++++++
 dom/media/tests/crashtests/crashtests.list      | 42 +++++++++++++++
 dom/media/tests/crashtests/datachannel-oom.html | 22 ++++++++
 44 files changed, 1069 insertions(+)
 create mode 100644 dom/media/tests/crashtests/1281695.html
 create mode 100644 dom/media/tests/crashtests/1306476.html
 create mode 100644 dom/media/tests/crashtests/1348381.html
 create mode 100644 dom/media/tests/crashtests/1367930_1.html
 create mode 100644 dom/media/tests/crashtests/1367930_2.html
 create mode 100644 dom/media/tests/crashtests/1429507_1.html
 create mode 100644 dom/media/tests/crashtests/1429507_2.html
 create mode 100644 dom/media/tests/crashtests/1443212.html
 create mode 100644 dom/media/tests/crashtests/1453030.html
 create mode 100644 dom/media/tests/crashtests/1468451.html
 create mode 100644 dom/media/tests/crashtests/1490700.html
 create mode 100644 dom/media/tests/crashtests/1505957.html
 create mode 100644 dom/media/tests/crashtests/1509442-1.html
 create mode 100644 dom/media/tests/crashtests/1509442.html
 create mode 100644 dom/media/tests/crashtests/1510848.html
 create mode 100644 dom/media/tests/crashtests/1511130.html
 create mode 100644 dom/media/tests/crashtests/1516292.html
 create mode 100644 dom/media/tests/crashtests/1573536.html
 create mode 100644 dom/media/tests/crashtests/1576938.html
 create mode 100644 dom/media/tests/crashtests/1594136.html
 create mode 100644 dom/media/tests/crashtests/1749308.html
 create mode 100644 dom/media/tests/crashtests/1764915.html
 create mode 100644 dom/media/tests/crashtests/1764933.html
 create mode 100644 dom/media/tests/crashtests/1764940.html
 create mode 100644 dom/media/tests/crashtests/1766668.html
 create mode 100644 dom/media/tests/crashtests/1783765.html
 create mode 100644 dom/media/tests/crashtests/780790.html
 create mode 100644 dom/media/tests/crashtests/791270.html
 create mode 100644 dom/media/tests/crashtests/791278.html
 create mode 100644 dom/media/tests/crashtests/791330.html
 create mode 100644 dom/media/tests/crashtests/799419.html
 create mode 100644 dom/media/tests/crashtests/801227.html
 create mode 100644 dom/media/tests/crashtests/802982.html
 create mode 100644 dom/media/tests/crashtests/812785.html
 create mode 100644 dom/media/tests/crashtests/822197.html
 create mode 100644 dom/media/tests/crashtests/834100.html
 create mode 100644 dom/media/tests/crashtests/836349.html
 create mode 100644 dom/media/tests/crashtests/837324.html
 create mode 100644 dom/media/tests/crashtests/855796.html
 create mode 100644 dom/media/tests/crashtests/860143.html
 create mode 100644 dom/media/tests/crashtests/861958.html
 create mode 100644 dom/media/tests/crashtests/863929.html
 create mode 100644 dom/media/tests/crashtests/crashtests.list
 create mode 100644 dom/media/tests/crashtests/datachannel-oom.html

(limited to 'dom/media/tests')

diff --git a/dom/media/tests/crashtests/1281695.html b/dom/media/tests/crashtests/1281695.html
new file mode 100644
index 0000000000..9865c3a509
--- /dev/null
+++ b/dom/media/tests/crashtests/1281695.html
@@ -0,0 +1,24 @@
+
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function zombieWindow()
+{
+    var frame = document.createElement("iframe");
+    document.body.appendChild(frame);
+    var frameWin = frame.contentWindow;
+    frame.remove();
+    return frameWin;
+}
+
+function boom() {
+    zombieWindow().navigator.mozGetUserMedia({ "fake": true, "audio": true }, function(stream) {}, function(e) {});
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/media/tests/crashtests/1306476.html b/dom/media/tests/crashtests/1306476.html
new file mode 100644
index 0000000000..d15cbe57df
--- /dev/null
+++ b/dom/media/tests/crashtests/1306476.html
@@ -0,0 +1,47 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+  <meta charset=utf-8>
+  <title>Bug 1348381: Integer overflow playing vorbis file</title>
+</head>
+<body>
+  <audio id=player controls
+        src="data:audio/ogg;base64,T2dnUwACAAAAAAAAAAD+ML0RAAAAACtaCMoBHgF2b3JiaXMAAAAAAkSsAAAAAAAAAHECAAAAAAC4AU9nZ1MAAAAAAAAAAAAA/jC9EQEAAACZyDL8E/8a/////////////////////5EDdm9yYmlzLQAAAFhpcGguT3JnIGxpYlZvcmJpcyBJIDIwMTAxMTAxIChTY2hhdWZlbnVnZ2V0KRAAAAAbAAAARU5DT0RFUj1Ib29rRmxhc2hPZ2dFbmNvZGVyBwAAAFRJVExFPWYIAAAAVkVSU0lPTj0HAAAAQUxCVU09YQwAAABUUkFDS05VTUJFUj0IAAAAQVJUSVNUPWEKAAAAUEVSRk9STUVSPQoAAABDT1BZUklHSFQ9CAAAAExJQ0VOU0U9DQAAAE9SR0FOSVpBVElPTj0MAAAAREVTQ1JJUFRJT049BgAAAEdFTlJFPQUAAABEQVRFPQoAAABMT0NBVElPTj1mCAAAAENPTlRBQ1Q9BQAAAElTUkM9AQV2b3JiaXMpQkNWAQAIAAAAMUwgxYDQkFUAABAAAGAkKQ6TZkkppZShKHmYlEhJKaWUxTCJmJSJxRhjjDHGGGOMMcYYY4wgNGQVAAAEAIAoCY6j5klqzjlnGCeOcqA5aU44pyAHilHgOQnC9SZjbqa0pmtuziklCA1ZBQAAAgBASCGFFFJIIYUUYoghhhhiiCGHHHLIIaeccgoqqKCCCjLIIINMMumkk0466aijjjrqKLTQQgsttNJKTDHVVmOuvQZdfHPOOeecc84555xzzglCQ1YBACAAAARCBhlkEEIIIYUUUogppphyCjLIgNCQVQAAIACAAAAAAEeRFEmxFMuxHM3RJE/yLFETNdEzRVNUTVVVVVV1XVd2Zdd2ddd2fVmYhVu4fVm4hVvYhV33hWEYhmEYhmEYhmH4fd/3fd/3fSA0ZBUAIAEAoCM5luMpoiIaouI5ogOEhqwCAGQAAAQAIAmSIimSo0mmZmquaZu2aKu2bcuyLMuyDISGrAIAAAEABAAAAAAAoGmapmmapmmapmmapmmapmmapmmaZlmWZVmWZVmWZVmWZVmWZVmWZVmWZVmWZVmWZVmWZVmWZVmWZVlAaMgqAEACAEDHcRzHcSRFUiTHciwHCA1ZBQDIAAAIAEBSLMVyNEdzNMdzPMdzPEd0RMmUTM30TA8IDVkFAAACAAgAAAAAAEAxHMVxHMnRJE9SLdNyNVdzPddzTdd1XVdVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVgdCQVQAABAAAIZ1mlmqACDOQYSA0ZBUAgAAAABihCEMMCA1ZBQAABAAAiKHkIJrQmvPNOQ6a5aCpFJvTwYlUmye5qZibc84555xszhnjnHPOKcqZxaCZ0JpzzkkMmqWgmdCac855EpsHranSmnPOGeecDsYZYZxzzmnSmgep2Vibc85Z0JrmqLkUm3POiZSbJ7W5VJtzzjnnnHPOOeecc86pXpzOwTnhnHPOidqba7kJXZxzzvlknO7NCeGcc84555xzzjnnnHPOCUJDVgEAQAAABGHYGMadgiB9jgZiFCGmIZMedI8Ok6AxyCmkHo2ORkqpg1BSGSeldILQkFUAACAAAIQQUkghhRRSSCGFFFJIIYYYYoghp5xyCiqopJKKKsoos8wyyyyzzDLLrMPOOuuwwxBDDDG00kosNdVWY4215p5zrjlIa6W11lorpZRSSimlIDRkFQAAAgBAIGSQQQYZhRRSSCGGmHLKKaegggoIDVkFAAACAAgAAADwJM8RHdERHdERHdERHdERHc/xHFESJVESJdEyLVMzPVVUVVd2bVmXddu3hV3Ydd/Xfd/XjV8XhmVZlmVZlmVZlmVZlmVZlmUJQkNWAQAgAAAAQgghhBRSSCGFlGKMMcecg05CCYHQkFUAACAAgAAAAABHcRTHkRzJkSRLsiRN0izN8jRP8zTRE0VRNE1TFV3RFXXTFmVTNl3TNWXTVWXVdmXZtmVbt31Ztn3f933f933f933f933f13UgNGQVACABAKAjOZIiKZIiOY7jSJIEhIasAgBkAAAEAKAojuI4jiNJkiRZkiZ5lmeJmqmZnumpogqEhqwCAAABAAQAAAAAAKBoiqeYiqeIiueIjiiJlmmJmqq5omzKruu6ruu6ruu6ruu6ruu6ruu6ruu6ruu6ruu6ruu6ruu6ruu6QGjIKgBAAgBAR3IkR3IkRVIkRXIkBwgNWQUAyAAACADAMRxDUiTHsixN8zRP8zTREz3RMz1VdEUXCA1ZBQAAAgAIAAAAAADAkAxLsRzN0SRRUi3VUjXVUi1VVD1VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVXVNE3TNIHQkJUAABkAAOSkptR6DhJikDmJQWgIScQcxVw66ZyjXIyHkCNGSe0hU8wQBLWY0EmFFNTiWmodc1SLja1kSEEttsZSIeWoB0JDVkgAoRkADscBHE0DHEsDAAAAAAAAAEnTAE0UAc0TAQAAAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcTQM0UQQ0UQQAAAAAAAAATRQB0VQB0TQBAAAAAAAAQBNFwDNFQDRVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcTQM0UQQ0UQQAAAAAAAAATRQBUTUBTzQBAAAAAAAAQBNFQDRNQFRNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAQ4AAAEWAYBaI2otWqMI4g+rV6R7YgzqBxzxPAoABKTZEc+jAEBAmt2aSlEkyDAZGaQAgEFQIwaNQYHcmv76xvuJ/wcax99/AZ0zMGTpUOBZywoG1CwdCjxrWcGA2ivJIydPYICNva3a22KANVRNW9VawWpYtxlBRKNoRFVtNAKK5l6EntQkF4KWe9GICIjE7u/fPwAsVsspu90EAtJ4sVpO2e0mEJDGfX0mCCtIRgqw2hs2thgWRRGrKhqNYFW1jUaHBnPzR9KhA62qaKTt0lorCvByEqsGFE13b7a3valOVDo93C5l45chA5VOD7dL2fhlyEC/1WMjJ9eSARsbq8Via9qoIBpVURUUrUVVxBYtoNGoYAWLVrFY8Vdr7cS7k6tkh06NVjG490Uuwwm6F8zQER+blAUoo9sLZuiIj03KApTRfQMAtHPTtHN3cGAHYgdiBwcWE2NmYiYWI5lYzEFMDACRjQwCaqidHXY2hmKqrR2U8AUEBSUJkaSUCHIYSys22qCqhloxDQyrVqxbmBZqWBqmIGphGsRtI0Rid3VfV1mXJ7JPVmu9q+7GrVvfm2kjUrY7ROptTtm3tbe3HDIuHVSouNbv6+rbp6rrSZpzeR3XrX3lHI6yvM05oizLXFIfVKGp2n3YOmsdLnnhlQYmR75CTGb/jfhdnW3YNpAEAnXJwma/fsLhWuQmJvPYpIDNr7Co8CT3E5BKNFIVNEd7zvzb7YSz4MjkbesITFOkm31cmuzakWtRemIWJS4kmEAHvAG2VRzkR8jjgIBJbt4qDvIj5HFAwCQ3fwMAWKGd6fRUDg4ODg6pxFI5iDExKcYksSNmBwdiEgASSpKBrdWwEau9YWcx7Q3TTsGKSPH5lCPJ8PgMR0JQLU3rat2wboGhNphWoTWf9Uaj6hBrbQVUBOrrbsjiTkhNgifk3KokPYYuda3NCanhbynzmtIIPvousqsQ3I7srnSltNMWcUXVGKNYQVEFVSyU0IbUMDVfty1hxIhYg2AUayfSnyRlSTpCi1u2fUpfwGocsAO2am7iqeSMLE8qAl5YxGXkHk+3u3mE9RpnU8AdgBquBRx95LgFW0EstsYWV8aAAyhgfWTLOmQTu6OyNnW11KZoGZcEsHG4CgDE5fQGGEJ0oN40Lqc3wBCiA/WmybF9yMkxJkPAME1Vi4X4ikjOzy5yRq/WfQvko9IVCh048w4AlOlKMhDQELEEKNOVZCCgIWIJcNVkIYIgOTnGCKgxCqpWtSCqLB2fIKBYWwZTR0M34MzSw9YrJVoyXOnKkickETWIkRrFK11Z8oQkogYxUqN4QJ0KpUQuiDEZAkZVjDX2rpD0JPOmpxC0omAB2d7qRMVSYej7AJTtyiroUp8glO3KKuhSnyAcUNaURUQgJyeDgREwqLWoStY5HWlFLaug6o9Exyo2b0PvdWCrAHTtSqvyTCiaI7qaQl270qo8E4rmiK6m0AE1WS8COQwYGCOgYAF7SRItrmUL2rZPTRXKE5zrsNeW9JACpO08WWIQtWJT0naeLDGIWrEpydHvAQsDY4yAvY1hY9oYhmpTOUO10Yh4s+9OnOSTJ5v2dla8BqztNGvcm+D/TcPaTrPGvQn+3zRcdQtkCjYyckENwFhrjYhRVVVFK5quP5Wq1WmwFjBVrdpoQRDRXinN2XCfailzkQAAAIA2GtsAfPH0ymO3Z9ZiKfl+8fTKY7dn1mIp+SbH9FhCM3JYDQArdqatYavebdaKKqpYVFsDtsagik7qkrZmHVRE8sUrdREWnZ++xFoUsTUiIAAaRrTRzkF+YE6h4g8j2mjnID8wp1Dxf1BUsqjNora2rKemUq0bAWQUWeQZCanEHBwcOYg5iDk4iDEzMzMzsRgzADHGYlStClhEsIKqgrUWjMUwTbUTw2pvYwOGqShaRdWKjUa1qOgARdEaUQHVJBMLvvTOJ+/iYffofiUvXXGB5E0fLYMk4ZcnUZZR5kxNIBbQAmLBpCs72845IOcSMkVL/QaXNCBl9LpOnlT5JC5nvBkkSssEp3Ehr3ZSazaRS+cYVDsW0fUf/VH35/UEhg9aWD+sBV0flgh2QEo+O1zCGwwcXn0EmCbfDax9dK9WJr11d6thwEHWcIdYQwGhIE8BAU9nZ1MABACAAAAAAAAA/jC9EQQAAAAyphcAAv8I3mSkYBs5OFY2oMlIwTZycKxswL45pIhNBxZzEGMxB3YQI2BmJmYGACBqYdWadSuWYmGzLayatrClhVgailpYt8lma5ZqxUabbLbBuoWa1my2wVLENFSNVmNEVVSxWLFct2XOfHVfrXFrMVjRalRE1WgVVbZu3Zp3J/Wusrl16wcxiMViwYqq0SoWEIsFLJZaa5V8m/Otq6y6zc395/XWD7XedddtNueOqTWucncSeRWAnL1vgRP2C2Dza03kzL5OcmmSqULlslzl7iqsc0c/y2ZmtVauklUysipXSa3rN2Q2OSE3S26wfm/IPfeEzE3n5vszm3vI/QJwkk29k8w=">
+  </audio>
+  <div id=result>
+  </div>
+
+  <script type="application/javascript">
+    function done() {
+      // Remove reftest-wait to terminate the test.
+      document.documentElement.removeAttribute("class");
+    }
+
+    function log(msg) {
+      // Append a status result.
+      let p = document.createElement("p");
+      p.textContent = msg;
+      document.getElementById("result").appendChild(p);
+    }
+
+    // Confirm playback completes.
+    let a = document.getElementById("player");
+    a.addEventListener("ended", () => {
+      log("Playback completed.");
+      done();
+    });
+    a.addEventListener("error", () => {
+      log("Playback error.");
+    });
+
+    log("Starting playback...");
+    a.play();
+
+    // Set a short timeout in case we hang.
+    setTimeout(() => {
+      log("Timed out!");
+      done();
+    }, 100);
+  </script>
+</body>
+</html>
diff --git a/dom/media/tests/crashtests/1348381.html b/dom/media/tests/crashtests/1348381.html
new file mode 100644
index 0000000000..b872e58794
--- /dev/null
+++ b/dom/media/tests/crashtests/1348381.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+  <title>Bug 1348381: Crash when recording extremely large canvas' captureStream</title>
+</head>
+</body>
+<canvas id="c" height="0.6"></canvas>
+<img id="img" src="data:image/gif;base64,R0lGODlhAQABAAAAACwAAAAAAQABAAA="></img>
+<script type="application/javascript">
+const c = document.getElementById("c");
+const ctx = c.getContext('2d');
+const s = c.captureStream(0);
+const mr = new MediaRecorder(s);
+const t = s.getVideoTracks()[0];
+mr.start();
+const img = document.getElementById('img');
+t.enabled = false;
+ctx.drawImage(img, 16, 18014398509481984);
+setTimeout(() => document.documentElement.removeAttribute("class"), 100);
+</script>
+</body>
+</html>
diff --git a/dom/media/tests/crashtests/1367930_1.html b/dom/media/tests/crashtests/1367930_1.html
new file mode 100644
index 0000000000..a4039a61a7
--- /dev/null
+++ b/dom/media/tests/crashtests/1367930_1.html
@@ -0,0 +1,39 @@
+<html>
+<body>
+  <script>
+var offer= "v=0\r\no=- 6276735615230473072 2 IN IP4 127.0.0.1\r\ns=-\r\nt=0 0\r\na=group:BUNDLE video\r\na=msid-semantic:WMS *\r\na=ice-ufrag:XoEUdw==\r\na=ice-pwd:hfNjAs9TU4NNuumB50mGfJwkqIEN8A==\r\na=ice-lite\r\na=setup:actpass\r\na=fingerprint:sha-256 0D:54:F2:D9:F3:10:00:2D:CD:14:C6:AC:CB:5D:E7:34:5E:6F:A8:BF:25:96:48:40:0B:C7:F9:18:6A:A6:73:3F\r\nm=video 9 UDP/TLS/RTP/SAVPF 100\r\nc=IN IP4 0.0.0.0\r\na=rtcp:9 IN IP4 0.0.0.0\r\na=mid:video\r\na=recvonly\r\na=rtcp-rsize\r\na=rtcp-mux\r\na=rtpmap:100 VP8/90000\r\na=rtcp-fb:100 ccm fir\r\na=rtcp-fb:100 nack\r\na=rtcp-fb:100 nack pli\r\na=rtcp-fb:100 goog-remb\r\na=extmap:2 urn:ietf:params:rtp-hdrext:toffset\r\na=extmap:3 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time\r\na=extmap:4 urn:3gpp:video-orientation\r\na=extmap:5 urn:ietf:params:rtp-hdrext:sdes:rtp-stream-id\r\na=rid:hi recv\r\na=rid:mid recv\r\na=rid:lo recv\r\na=simulcast: recv rid=hi,mid,lo\r\na=candidate:1796272311 1 UDP 2130706431 192.168.10.146 55984 typ host\r\na=end-of-candidates\r\n"
+
+var data = {};
+data.sdp = offer;
+data.type = "offer";
+
+console.log('OFFER', JSON.stringify(data.sdp));
+
+var pc = new RTCPeerConnection();
+
+navigator.mediaDevices.getUserMedia({video: true, fake: true})
+  .then((stream) => {
+    return pc.addStream(stream);
+  })
+  .then(() => {
+    return pc.setRemoteDescription(new RTCSessionDescription(data));
+  })
+  .then(function() {
+      var sender = pc.getSenders()[0];
+      console.log('setting parameters');
+      return sender.setParameters({encodings: [
+          {rid: "hi", maxBitrate: 800000},
+          {rid: "mid", maxBitrate: 400000, scaleDownResolutionBy: 2},
+          {rid: "lo", maxBitrate: 150000, scaleDownResolutionBy: 4}
+      ]});
+  })
+  .then(function() {
+      return pc.createAnswer();
+  })
+  .then(function(answer) {
+      console.log('answer', JSON.stringify(answer.sdp));
+      return pc.setLocalDescription(answer);
+  });
+  </script>
+</body>
+</html>
diff --git a/dom/media/tests/crashtests/1367930_2.html b/dom/media/tests/crashtests/1367930_2.html
new file mode 100644
index 0000000000..e2ee6720c6
--- /dev/null
+++ b/dom/media/tests/crashtests/1367930_2.html
@@ -0,0 +1,25 @@
+<html>
+  <body>
+    <script>
+const sdp = {"type":"offer","sdp":"v=0\r\no=- 6276735615230473072 2 IN IP4 127.0.0.1\r\ns=-\r\nt=0 0\r\na=group:BUNDLE video\r\na=msid-semantic:WMS *\r\na=ice-ufrag:XpXW4g==\r\na=ice-pwd:hjagMNwFF/kMOmWoULEFptwuQXkMVQ==\r\na=ice-lite\r\na=setup:actpass\r\na=fingerprint:sha-256 DC:FC:25:56:2B:88:77:2F:E4:FA:97:4E:2E:F1:D6:34:A6:A0:11:E2:E4:38:B3:98:08:D2:F7:9D:F5:E2:C1:15\r\nm=video 9 UDP/TLS/RTP/SAVPF 100\r\nc=IN IP4 0.0.0.0\r\na=rtcp:9 IN IP4 0.0.0.0\r\na=mid:video\r\na=recvonly\r\na=rtcp-rsize\r\na=rtcp-mux\r\na=rtpmap:100 VP8/90000\r\na=rtcp-fb:100 ccm fir\r\na=rtcp-fb:100 nack\r\na=rtcp-fb:100 nack pli\r\na=rtcp-fb:100 goog-remb\r\na=extmap:2 urn:ietf:params:rtp-hdrext:toffset\r\na=extmap:3 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time\r\na=extmap:4 urn:3gpp:video-orientation\r\na=extmap:5 urn:ietf:params:rtp-hdrext:sdes:rtp-stream-id\r\na=rid:hi recv\r\na=rid:mid recv\r\na=rid:lo recv\r\na=simulcast: recv rid=hi;mid;lo\r\na=candidate:1796272311 1 UDP 2130706431 127.0.0.1 33584 typ host\r\na=end-of-candidates\r\n"};
+
+var pc = new RTCPeerConnection();
+
+navigator.mediaDevices.getUserMedia({video: true, fake: true})
+.then(stream => pc.addStream(stream))
+.then(() => {
+            console.log('hum');
+            pc.setRemoteDescription(sdp)
+            .then(function() {
+                return pc.createAnswer();
+            })
+            .then(function(answer) {
+                console.log(answer.sdp);
+                return pc.setLocalDescription(answer);
+            })
+            .then(console.log('yay'))
+            .catch(e => console.error(e));
+})
+    </script>
+  </body>
+</html>
diff --git a/dom/media/tests/crashtests/1429507_1.html b/dom/media/tests/crashtests/1429507_1.html
new file mode 100644
index 0000000000..894abf911a
--- /dev/null
+++ b/dom/media/tests/crashtests/1429507_1.html
@@ -0,0 +1,13 @@
+<html>
+  <body>
+    <script>
+      try { o1 = window.open("") } catch (e) {}
+      try { o1.location.reload() } catch (e) {}
+      try { o2 = new RTCPeerConnection({iceServers: [{"url": "stun:d"}]}) } catch (e) {}
+      try { o1.navigator.mediaDevices.getUserMedia({video: true, fake: true}).catch((error) => {}) } catch (e) {}
+      try { o2.createOffer({offerToReceiveVideo: true}).then((offer) => {
+        try { o1.navigator.mediaDevices.getUserMedia({video: true}) } catch (e) {};
+      }) } catch (e) {}
+    </script>
+  </body>
+</html>
diff --git a/dom/media/tests/crashtests/1429507_2.html b/dom/media/tests/crashtests/1429507_2.html
new file mode 100644
index 0000000000..d5f15b648e
--- /dev/null
+++ b/dom/media/tests/crashtests/1429507_2.html
@@ -0,0 +1,15 @@
+<html>
+  <body>
+    <script>
+      try { o1 = window.open("") } catch(e) { }
+      try { o1.location.reload() } catch(e) { }
+      try { o2 = o1.navigator } catch(e) { }
+      try { o3 = o2.mediaDevices } catch(e) { }
+      try { o4 = new XMLHttpRequest() } catch(e) { }
+      try { o3.getUserMedia({video: true, fake: true }).then((stream) => {}).catch((error) => {}) } catch (e) {}
+      try { o4.open("T", "aa", false) } catch(e) { }
+      try { o4.send() } catch(e) { }
+      try { o3.getUserMedia({video: true}).then((stream) => {}).catch((error) => {}) } catch (e) {}
+    </script>
+  </body>
+</html>
diff --git a/dom/media/tests/crashtests/1443212.html b/dom/media/tests/crashtests/1443212.html
new file mode 100644
index 0000000000..3f0eedac90
--- /dev/null
+++ b/dom/media/tests/crashtests/1443212.html
@@ -0,0 +1,13 @@
+<script>
+window.addEventListener("load", () => {
+  const c = document.createElement("canvas");
+  c.getContext("2d");
+  const stream = c.captureStream();
+  const [track] = stream.getTracks();
+  stream.removeTrack(track);
+  track.stop();
+  stream.addTrack(track);
+  stream.removeTrack(track);
+  stream.addTrack(track);
+});
+</script>
diff --git a/dom/media/tests/crashtests/1453030.html b/dom/media/tests/crashtests/1453030.html
new file mode 100644
index 0000000000..9452ec1205
--- /dev/null
+++ b/dom/media/tests/crashtests/1453030.html
@@ -0,0 +1,19 @@
+<html class="reftest-wait">
+  <head>
+    <script>
+      function getDTMF () {
+        try { o4 = o2.dtmf } catch(e) { }
+        try { o4.insertDTMF("1BC1D55", new Uint32Array([3538134876])[0], new Uint32Array([666182017])[0]) } catch (e) { }
+        document.documentElement.removeAttribute("class");
+      }
+
+      o1 = new RTCPeerConnection({ }, null)
+      window.navigator.mediaDevices.getUserMedia({video: true, fake: true}).then((stream) => {
+        o2 = o1.addTrack(stream.getVideoTracks()[0], stream)
+      }).catch((error) => {})
+      o3 = window.open("datr=0")
+      setTimeout(getDTMF, 400)
+      setTimeout(window.location.reload.bind(window.location), 500);
+    </script>
+  </head>
+</html>
diff --git a/dom/media/tests/crashtests/1468451.html b/dom/media/tests/crashtests/1468451.html
new file mode 100644
index 0000000000..40f2efac0d
--- /dev/null
+++ b/dom/media/tests/crashtests/1468451.html
@@ -0,0 +1,10 @@
+<script>
+alice = new RTCPeerConnection({ iceServers: [{ 'url': 'stun:2' }], }, null)
+bob = new RTCPeerConnection({ }, null)
+alice.createOffer({ offerToReceiveAudio: true })
+track = alice.getReceivers()[0].track
+alice.createOffer({ }).then((offer) => {
+  bob.addEventListener('signalingstatechange', (x) => x.target.addTransceiver(track, {}), { })
+  bob.close()
+})
+</script>
diff --git a/dom/media/tests/crashtests/1490700.html b/dom/media/tests/crashtests/1490700.html
new file mode 100644
index 0000000000..ea881c3096
--- /dev/null
+++ b/dom/media/tests/crashtests/1490700.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+  <title>Bug 1490700 - Divide-by-zero for screen-capture with max-dimension 0</title>
+</head>
+</body>
+<script type="application/javascript">
+async function test() {
+  SpecialPowers.wrap(document).notifyUserGestureActivation();
+  await window.navigator.mediaDevices.getUserMedia({
+    video: {
+      mediaSource: 'screen',
+      height: {max: 0},
+    },
+  });
+  await window.navigator.mediaDevices.getUserMedia({
+    video: {
+      mediaSource: 'screen',
+      advanced: [{height: 0}],
+    },
+  });
+  document.documentElement.removeAttribute("class");
+}
+
+test();
+</script>
+</body>
+</html>
diff --git a/dom/media/tests/crashtests/1505957.html b/dom/media/tests/crashtests/1505957.html
new file mode 100644
index 0000000000..7b0780a9cf
--- /dev/null
+++ b/dom/media/tests/crashtests/1505957.html
@@ -0,0 +1,23 @@
+<html id='a'>
+<script>
+window.onload=function() {
+    b.src=document.getElementById('c').innerHTML;
+    b.setAttribute('src', 'video-crash.webm');
+    document.documentElement.style.display='none';
+    window.top.open('');
+    var o = window.frames[0].document.body.childNodes[0];
+    document.getElementById('d').appendChild(o.parentNode.removeChild(o));
+    o = document.getElementById('a');
+    var p = o.parentNode;
+    o.setAttribute('id', 0)
+    p.removeChild(o);
+    p.appendChild(o);
+    o.setAttribute('style', 0)
+    p.removeChild(o);
+    p.appendChild(o);
+}
+</script>
+<iframe id='b'></iframe>
+<object id='c'>
+<ruby id='d'>
+</html>
diff --git a/dom/media/tests/crashtests/1509442-1.html b/dom/media/tests/crashtests/1509442-1.html
new file mode 100644
index 0000000000..eef877ecf8
--- /dev/null
+++ b/dom/media/tests/crashtests/1509442-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE HTML>
+<meta charset="UTF-8">
+<script>
+    function start() {
+        o5=new AudioContext();
+        o291=new Float32Array(0);
+        o388=document.write("");
+        o389=o5.createBuffer(2,22050,44100);
+        o420=new AudioBufferSourceNode(o5, {buffer:o389,detune:27});
+        o389.copyToChannel(o291,1,0);
+        document.close();
+    }
+</script>
+<body onload="start()"></body>
diff --git a/dom/media/tests/crashtests/1509442.html b/dom/media/tests/crashtests/1509442.html
new file mode 100644
index 0000000000..ddce401933
--- /dev/null
+++ b/dom/media/tests/crashtests/1509442.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<meta charset="UTF-8">
+<body>
+<iframe src="1509442-1.html" onload="document.documentElement.removeAttribute('class')"></iframe>
+</body>
+</html>
diff --git a/dom/media/tests/crashtests/1510848.html b/dom/media/tests/crashtests/1510848.html
new file mode 100644
index 0000000000..05e2c2d852
--- /dev/null
+++ b/dom/media/tests/crashtests/1510848.html
@@ -0,0 +1,4 @@
+<a>
+<dd>
+<video>
+<a>
diff --git a/dom/media/tests/crashtests/1511130.html b/dom/media/tests/crashtests/1511130.html
new file mode 100644
index 0000000000..6bdebe8de1
--- /dev/null
+++ b/dom/media/tests/crashtests/1511130.html
@@ -0,0 +1,12 @@
+<script>
+document.addEventListener("DOMContentLoaded", function(){
+  var o = window.frames[0].document.body.childNodes[0];
+  a.appendChild(o.parentNode.removeChild(o));
+  o = document.body;
+  o.parentNode.appendChild(o);
+  o.parentNode.appendChild(o);
+})
+</script>
+<body text=''>
+<hgroup id='a'>
+<iframe src="video-crash.webm"></iframe>
diff --git a/dom/media/tests/crashtests/1516292.html b/dom/media/tests/crashtests/1516292.html
new file mode 100644
index 0000000000..93c844c939
--- /dev/null
+++ b/dom/media/tests/crashtests/1516292.html
@@ -0,0 +1,16 @@
+<script>
+function go() {
+  a.children[0].appendChild(b)
+}
+</script>
+<body onload=go()>
+<svg id="a">
+<foreignObject>
+<li>
+<video controls="" autoplay="">
+<li id="a" contenteditable="true">
+</li>
+</svg>
+<canvas id="b">
+<svg>
+<use xlink:href="#a">
diff --git a/dom/media/tests/crashtests/1573536.html b/dom/media/tests/crashtests/1573536.html
new file mode 100644
index 0000000000..1283183254
--- /dev/null
+++ b/dom/media/tests/crashtests/1573536.html
@@ -0,0 +1,18 @@
+<html class="reftest-wait">
+<head>
+    <script>
+      function start () {
+        window.navigator.mediaDevices.getUserMedia({
+          'audio': {
+            'mediaSource': 'audioCapture'
+          },
+          'video': true,
+          'fake': true
+        }).catch(() => Promise.resolve())
+          .then(() => document.documentElement.removeAttribute("class"))
+      }
+
+      window.addEventListener('load', start)
+    </script>
+</head>
+</html>
diff --git a/dom/media/tests/crashtests/1576938.html b/dom/media/tests/crashtests/1576938.html
new file mode 100644
index 0000000000..71a785e299
--- /dev/null
+++ b/dom/media/tests/crashtests/1576938.html
@@ -0,0 +1,16 @@
+<html class="reftest-wait">
+<head>
+<script>
+async function start () {
+  const peer = new RTCPeerConnection()
+  await peer.createOffer({'offerToReceiveVideo': true})
+  const receiver = peer.getReceivers()[0]
+  peer.close()
+  receiver.track.clone()
+  document.documentElement.removeAttribute("class")
+}
+
+document.addEventListener('DOMContentLoaded', start)
+</script>
+</head>
+</html>
diff --git a/dom/media/tests/crashtests/1594136.html b/dom/media/tests/crashtests/1594136.html
new file mode 100644
index 0000000000..7f3189257e
--- /dev/null
+++ b/dom/media/tests/crashtests/1594136.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+<script>
+function start () {
+  const context = new AudioContext();
+  const {stream} = new MediaStreamAudioDestinationNode(context);
+  const [track] = stream.getTracks();
+  track.stop();
+  context.createMediaStreamTrackSource(track);
+}
+
+document.addEventListener('DOMContentLoaded', start);
+</script>
+</head>
+</html>
diff --git a/dom/media/tests/crashtests/1749308.html b/dom/media/tests/crashtests/1749308.html
new file mode 100644
index 0000000000..1c17c6e35c
--- /dev/null
+++ b/dom/media/tests/crashtests/1749308.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <script>
+    window.addEventListener("load", () => {
+      const context = new AudioContext({})
+      const controller = new AbortController()
+      let processor = context.createScriptProcessor(512, 27, 2)
+      processor.addEventListener("audioprocess", async () => {}, { signal: controller.signal })
+      processor = null;
+      SpecialPowers.forceGC()
+      for (let i = 0; i < 7; i++) {
+        controller.abort();
+      }
+    })
+  </script>
+</head>
+</html>
diff --git a/dom/media/tests/crashtests/1764915.html b/dom/media/tests/crashtests/1764915.html
new file mode 100644
index 0000000000..82534caac7
--- /dev/null
+++ b/dom/media/tests/crashtests/1764915.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+<script>
+window.addEventListener('load', async () => {
+  const frame = document.createElement('frame')
+  document.documentElement.appendChild(frame)
+  const peer = new RTCPeerConnection()
+  await peer.setRemoteDescription({}, () => {}, async () => await peer.getIdentityAssertion())
+  peer.close()
+})
+</script>
+</head>
+</html>
+
diff --git a/dom/media/tests/crashtests/1764933.html b/dom/media/tests/crashtests/1764933.html
new file mode 100644
index 0000000000..55f6fa2db9
--- /dev/null
+++ b/dom/media/tests/crashtests/1764933.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+    <script>
+      window.addEventListener('load', async () => {
+        const peer = new RTCPeerConnection({})
+        await peer.createOffer({ 'offerToReceiveVideo': true })
+        const receivers = peer.getReceivers()
+        const sender = peer.addTrack(receivers[0].track)
+        peer.close()
+        await sender.getStats()
+        await sender.replaceTrack(receivers[0].track)
+      })
+    </script>
+</head>
+</html>
diff --git a/dom/media/tests/crashtests/1764940.html b/dom/media/tests/crashtests/1764940.html
new file mode 100644
index 0000000000..67bce74b18
--- /dev/null
+++ b/dom/media/tests/crashtests/1764940.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+    <script>
+      document.addEventListener('DOMContentLoaded', async () => {
+        const peer = new RTCPeerConnection({ 'iceServers': [{ 'urls': 'stun:23.21.150.121' }] })
+        const offer = await peer.createOffer({ 'offerToReceiveVideo': true })
+        await peer.setRemoteDescription(offer)
+        const senders = peer.getSenders()
+        setTimeout(async () => await senders[1].setParameters({}), 334)
+        await peer.setRemoteDescription(offer)
+      })
+    </script>
+</head>
+</html>
diff --git a/dom/media/tests/crashtests/1766668.html b/dom/media/tests/crashtests/1766668.html
new file mode 100644
index 0000000000..0ea142e563
--- /dev/null
+++ b/dom/media/tests/crashtests/1766668.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<script>
+  document.addEventListener('DOMContentLoaded', async () => {
+    await navigator.mediaDevices.getUserMedia({ 'audio': {} })
+    const peer = new RTCPeerConnection({ 'iceServers': [{ 'urls': 'stun:23.21.150.121' }], 'peerIdentity': 'B' }, {})
+    const stream = await navigator.mediaDevices.getUserMedia({ 'audio': {} })
+    stream.getTracks().forEach((track) => peer.addTrack(track, stream))
+    try { offer = await peer.createOffer({}) } catch (e) { }
+    await peer.setRemoteDescription(offer)
+  })
+</script>
diff --git a/dom/media/tests/crashtests/1783765.html b/dom/media/tests/crashtests/1783765.html
new file mode 100644
index 0000000000..333ad8d444
--- /dev/null
+++ b/dom/media/tests/crashtests/1783765.html
@@ -0,0 +1,22 @@
+<script>
+var timeout = async function (cmd) {
+  const timer = new Promise((resolve, reject) => {
+    const id = setTimeout(() => {
+      clearTimeout(id)
+      reject(new Error('Promise timed out!'))
+    }, 750)
+  })
+  return Promise.race([cmd, timer])
+}
+window.addEventListener('load', async () => {
+  let a = new RTCPeerConnection({
+    'iceServers': [{'urls': 'stun:23.21.150.121'}],
+    'peerIdentity': 'x',
+  })
+  let b = await timeout(a.createOffer({ }))
+  a.setLocalDescription(b)
+  try { a.setRemoteDescription(b) } catch (e) {}
+  a.setLocalDescription(b)
+})
+</script>
+
diff --git a/dom/media/tests/crashtests/780790.html b/dom/media/tests/crashtests/780790.html
new file mode 100644
index 0000000000..27eb2a961f
--- /dev/null
+++ b/dom/media/tests/crashtests/780790.html
@@ -0,0 +1,16 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=780790
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Simple gUM test - null success callback</title>
+  <script type="application/javascript">
+    navigator.mozGetUserMedia({video: true, fake: true}, null, null);
+  </script>
+</head>
+
+<body>
+</body>
+</html>
diff --git a/dom/media/tests/crashtests/791270.html b/dom/media/tests/crashtests/791270.html
new file mode 100644
index 0000000000..627552fb84
--- /dev/null
+++ b/dom/media/tests/crashtests/791270.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=791270
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Simple PeerConnection Video Test</title>
+  <script type="application/javascript">
+    var pc = new RTCPeerConnection();
+    pc.addStream(undefined);
+  </script>
+</head>
+
+<body>
+</body>
+</html>
diff --git a/dom/media/tests/crashtests/791278.html b/dom/media/tests/crashtests/791278.html
new file mode 100644
index 0000000000..fd538f6788
--- /dev/null
+++ b/dom/media/tests/crashtests/791278.html
@@ -0,0 +1,20 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=791278
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Simple PeerConnection Video Test - Invalid callback</title>
+  <script type="application/javascript">
+    var pc1 = new RTCPeerConnection();
+    pc1.setLocalDescription(function() {});
+
+    var pc2 = new RTCPeerConnection();
+    pc2.setRemoteDescription(function() {});
+  </script>
+</head>
+
+<body>
+</body>
+</html>
diff --git a/dom/media/tests/crashtests/791330.html b/dom/media/tests/crashtests/791330.html
new file mode 100644
index 0000000000..fea2059a29
--- /dev/null
+++ b/dom/media/tests/crashtests/791330.html
@@ -0,0 +1,35 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=791330
+-->
+<head>
+  <meta charset="utf-8">
+  <title>PeerConnection test - operate on closed connection</title>
+  <script type="application/javascript">
+    function finish() {
+      document.documentElement.removeAttribute("class");
+    }
+
+    function runTest() {
+      var pc = new RTCPeerConnection();
+      pc.close();
+
+      navigator.mozGetUserMedia({audio: true, fake: true}, function (stream) {
+        try {
+          pc.addStream(stream);
+          pc.createOffer(function (offer) {});
+        }
+        finally {
+          stream.getTracks().forEach(t => t.stop());
+
+          finish();
+        }
+      }, function () {});
+    }
+  </script>
+</head>
+
+<body onload="setTimeout(runTest, 100)">
+</body>
+</html>
diff --git a/dom/media/tests/crashtests/799419.html b/dom/media/tests/crashtests/799419.html
new file mode 100644
index 0000000000..7f815e73c8
--- /dev/null
+++ b/dom/media/tests/crashtests/799419.html
@@ -0,0 +1,32 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=799419
+-->
+<head>
+  <meta charset="utf-8">
+  <title>2 Peer Connections Create and Close + Fake Video</title>
+  <script type="application/javascript">
+    function finish() {
+      document.documentElement.removeAttribute("class");
+    }
+
+    function boom() {
+      var v0 = new RTCPeerConnection();
+      var v1 = new RTCPeerConnection();
+      var v2 = document.getElementById("pc1video");
+      var v3 = document.getElementById("pc2video");
+      navigator.mozGetUserMedia({video:true, fake: true},
+        function(stream) {}, function() {});
+      v0.close();
+      v1.close();
+
+      finish();
+    }
+  </script>
+</head>
+<body onload="setTimeout(boom, 100)">
+<video id="pc1video" width="100" height="100" controls></video>
+<video id="pc2video" width="100" height="100" controls></video>
+</body>
+</html>
diff --git a/dom/media/tests/crashtests/801227.html b/dom/media/tests/crashtests/801227.html
new file mode 100644
index 0000000000..2dded54510
--- /dev/null
+++ b/dom/media/tests/crashtests/801227.html
@@ -0,0 +1,35 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=801227
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Abort due to page reload</title>
+  <script type="application/javascript">
+    var pc = new RTCPeerConnection();
+
+    var index = localStorage.index || 0;
+    if (index < 3) {
+      localStorage.index = index + 1;
+      window.location.reload();
+    }
+
+    function finish() {
+      delete localStorage["index"];
+
+      pc.close();
+      document.documentElement.removeAttribute("class");
+    }
+
+    navigator.mozGetUserMedia({ audio: true, fake: true }, function (aStream) {
+      pc.addStream(aStream);
+      finish();
+    }, finish);
+  </script>
+</head>
+
+<body>
+</body>
+</html>
+
diff --git a/dom/media/tests/crashtests/802982.html b/dom/media/tests/crashtests/802982.html
new file mode 100644
index 0000000000..f034aff557
--- /dev/null
+++ b/dom/media/tests/crashtests/802982.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=802982
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Excessive getUserMedia calls</title>
+  <script type="application/javascript">
+
+  function finish() {
+    document.documentElement.removeAttribute("class");
+  }
+
+  function boom()
+  {
+    for (var j = 0; j < 100; ++j) {
+      navigator.mozGetUserMedia({video:true}, function(){}, function(){});
+    }
+    finish(); // we're not waiting for success/error callbacks here
+  }
+
+  </script>
+</head>
+
+<body onload="setTimeout(boom, 100)">
+</html>
diff --git a/dom/media/tests/crashtests/812785.html b/dom/media/tests/crashtests/812785.html
new file mode 100644
index 0000000000..f26168e49b
--- /dev/null
+++ b/dom/media/tests/crashtests/812785.html
@@ -0,0 +1,70 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=812785
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Bug 812785 - WebRTC use-after-free crash</title>
+  <script type="application/javascript">
+    var pc1, pc2, pc1_offer, pc2_answer, localAudio, remoteAudio;
+
+    function onFailure(code) {
+      stop();
+    }
+
+    function stop() {
+      pc1.close(); pc1 = null;
+      pc2.close(); pc2 = null;
+
+      var index = localStorage.index || 0;
+      if (index < 5) {
+        localStorage.index = index + 1;
+        window.location.reload();
+      }
+      else {
+        finish();
+      }
+    }
+
+    function start() {
+      localAudio = document.getElementById("local");
+      remoteAudio = document.getElementById("remote");
+
+      var stream = localAudio.mozCaptureStreamUntilEnded();
+
+      pc1 = new RTCPeerConnection();
+      pc2 = new RTCPeerConnection();
+
+      pc1.addStream(stream);
+      pc1.createOffer(function (offer) {
+        pc1_offer = offer;
+        pc1.setLocalDescription(pc1_offer, function () {
+          pc2.setRemoteDescription(pc1_offer, function () {
+            pc2.createAnswer(function (answer) {
+              pc2_answer = answer;
+              pc2.setLocalDescription(pc2_answer, function () {
+                pc1.setRemoteDescription(pc2_answer, function step6() {
+                  stop();
+                }, onFailure);
+              }, onFailure);
+            }, onFailure);
+          }, onFailure);
+        }, onFailure);
+      }, onFailure);
+    }
+
+    function finish() {
+      delete localStorage["index"];
+
+      document.documentElement.removeAttribute("class");
+    }
+  </script>
+</head>
+
+<body onload="setTimeout(start, 100)">
+  <audio id="local" controls autoplay><source type="audio/wav" src="" /></audio>
+  <audio id="remote" controls></audio>
+</body>
+</html>
+
diff --git a/dom/media/tests/crashtests/822197.html b/dom/media/tests/crashtests/822197.html
new file mode 100644
index 0000000000..97abc44229
--- /dev/null
+++ b/dom/media/tests/crashtests/822197.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=822197
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Bug 822197 - Many PeerConnections with CreateOffer</title>
+  <script type="application/javascript">
+    var pcArray = [];
+
+    function finish() {
+      document.documentElement.removeAttribute("class");
+    }
+
+    function start() {
+      for(var i = 0; i < 70; i++) {
+        var pc = new RTCPeerConnection();
+        pc.createOffer(function() {}, function() {});
+        pcArray.push(pc);
+      }
+      finish();
+    }
+  </script>
+</head>
+
+<body onload="setTimeout(start, 100)">
+</html>
diff --git a/dom/media/tests/crashtests/834100.html b/dom/media/tests/crashtests/834100.html
new file mode 100644
index 0000000000..0042581564
--- /dev/null
+++ b/dom/media/tests/crashtests/834100.html
@@ -0,0 +1,25 @@
+<html class="reftest-wait">
+  <head>
+    <script language="javascript">
+
+function start() {
+  remotePC = new RTCPeerConnection();
+  var cand = new RTCIceCandidate(
+                {candidate: "1 1 UDP 1 127.0.0.1 34567 type host",
+                 sdpMid: "helloworld",
+                 sdbMid: "helloworld", // Mis-spelt attribute for bug 833948 compatibility.
+                 sdpMLineIndex: 1
+                });
+  try {remotePC.addIceCandidate(cand);} catch(e) {} // bug 842075 - remove try when fixed
+  try {remotePC.addIceCandidate(cand, function(sdp){}, finish);} catch(e) {} // bug 842075 - remove try when fixed
+  finish();
+}
+
+function finish(arg) {
+  document.documentElement.removeAttribute("class");
+}
+    </script>
+  </head>
+  <body onload="setTimeout(start, 100)">
+  </body>
+</html>
diff --git a/dom/media/tests/crashtests/836349.html b/dom/media/tests/crashtests/836349.html
new file mode 100644
index 0000000000..651fde46ae
--- /dev/null
+++ b/dom/media/tests/crashtests/836349.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=836349
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Bug 836349</title>
+  <script type="application/javascript">
+    function crash()
+    {
+      var pc = new RTCPeerConnection();
+      var ld = pc.localDescription;
+      dump(ld.sdp);
+    }
+  </script>
+</head>
+
+<body onload="crash();">
+</html>
diff --git a/dom/media/tests/crashtests/837324.html b/dom/media/tests/crashtests/837324.html
new file mode 100644
index 0000000000..63162a336b
--- /dev/null
+++ b/dom/media/tests/crashtests/837324.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=837324
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Bug 837324</title>
+  <script type="application/javascript">
+    function finish() {
+      document.documentElement.removeAttribute("class");
+    }
+
+    function start() {
+      var o0 = new RTCPeerConnection();
+      var o1 = new RTCIceCandidate({"candidate":"0 -65535 IP 0 stun.sipgate.net 3227326073 type ::ffff:192.0.2.128 host 2302600701","sdpMid":"video 3907077665 RTP/SAVPF 5000","sdpMLineIndex":7});
+      try {o0.addIceCandidate(o1);} catch(e) {} // bug 842075 - remove try when fixed
+
+      finish();
+    }
+  </script>
+</head>
+
+<body onload="setTimeout(start, 100)">
+</html>
diff --git a/dom/media/tests/crashtests/855796.html b/dom/media/tests/crashtests/855796.html
new file mode 100644
index 0000000000..da46276c53
--- /dev/null
+++ b/dom/media/tests/crashtests/855796.html
@@ -0,0 +1,66 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=855796
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Bug 855796</title>
+  <script type="application/javascript">
+    var pc1, pc2, pc1_offer, pc2_answer;
+
+    function onFailure(code) {
+      stop();
+    }
+
+    function stop() {
+      pc1.close();
+      pc1 = null;
+      pc2.close();
+      pc2 = null;
+      document.documentElement.removeAttribute("class");
+    }
+
+    function step1(offer) {
+      pc1_offer = offer;
+      pc1_offer.sdp = "v=0\r\no=Mozilla-SIPUA 2208 0 IN IP4 0.0.0.0\r\ns=SIP Call\r\nt=0 0\r\na=ice-pwd:4450d5a4a5f097855c16fa079893be18\r\na=fingerprint:sha-256 23:9A:2E:43:94:42:CF:46:68:FC:62:F9:F4:48:61:DB:2F:8C:C9:FF:6B:25:54:9D:41:09:EF:83:A8:19:FC:B6\r\nm=audio 56187 RTP/SAVPF 109 0 8 101\r\nc=IN IP4 77.9.79.167\r\na=rtpmap:109 opus/48000/2\r\na=ptime:20\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-15\r\na=sendrecv\r\na=candidate:0 1 UDP 2113601791 192.168.178.20 56187 typ host\r\na=candidate:1 1 UDP 1694236671 77.9.79.167 56187 typ srflx raddr 192.168.178.20 rport 56187\r\na=candidate:0 2 UDP 2113601790 192.168.178.20 52955 typ host\r\na=candidate:1 2 UDP 1694236670 77.9.79.167 52955 typ srflx raddr 192.168.178.20 rport 52955\r\nm=video 49929 RTP/SAVPF 120\r\nc=IN IP4 77.9.79.167\r\na=rtpmap:120 VP8/90000\r\na=recvonly\r\na=candidate:0 1 UDP 2113601791 192.168.178.20 49929 typ host\r\na=candidate:1 1 UDP 1694236671 77.9.79.167 49929 typ srflx raddr 192.168.178.20 rport 49929\r\na=candidate:0 2 UDP 2113601790 192.168.178.20 50769 typ host\r\na=candidate:1 2 UDP 1694236670 77.9.79.167 50769 typ srflx raddr 192.168.178.20 rport 50769\r\nm=application 54054 SCTP/DTLS 5000 \r\nc=IN IP4 77.9.79.167\r\na=fmtp:HuRUu]Dtcl\\zM,7(OmEU%O$gU]x/z\tD protocol=webrtc-datachannel;streams=16\r\na=sendrecv\r\n";
+      pc1.setLocalDescription(pc1_offer, step2, onFailure);
+    }
+
+    function step2() {
+      pc2.setRemoteDescription(pc1_offer, step3, onFailure);
+    }
+
+    function step3() {
+      pc2.createAnswer(step4, onFailure);
+    }
+
+    function step4(answer) {
+      pc2_answer = answer;
+      pc2.setLocalDescription(pc2_answer, step5, onFailure);
+    }
+
+    function step5() {
+      pc1.setRemoteDescription(pc2_answer, step6, onFailure);
+    }
+
+    function step6() {
+      stop();
+    }
+
+    function start() {
+      pc1 = new RTCPeerConnection();
+      pc2 = new RTCPeerConnection();
+      navigator.mozGetUserMedia({audio:true, video:true, fake:true}, function(s) {
+          pc1.addStream(s);
+          navigator.mozGetUserMedia({audio:true, video:true, fake:true}, function(s) {
+            pc2.addStream(s);
+            pc1.createOffer(step1, onFailure);
+        }, onFailure);
+      }, onFailure);
+    }
+  </script>
+</head>
+
+<body onload="setTimeout(start, 100)">
+</html>
diff --git a/dom/media/tests/crashtests/860143.html b/dom/media/tests/crashtests/860143.html
new file mode 100644
index 0000000000..2d17a8dace
--- /dev/null
+++ b/dom/media/tests/crashtests/860143.html
@@ -0,0 +1,25 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=860143
+-->
+<head>
+  <meta charset="utf-8">
+  <title>bug 860143</title>
+  <script type="application/javascript">
+    function start() {
+      var o0 = new window.RTCPeerConnection({
+        iceServers: [
+          {
+            url: "turn:AAAAAAAAAAAAAAAAA        AAAAAAAAAAA  AAAAAAAAAAAAA AA AAAAA        AAAAAAAAAAA  AAAAAAAAAAAAAAAA AAAAA        AAAAAAAAAA, AAAAAAAAAAAAAAAA        AAA    AAAAAAAAAAAAAAA"
+          }
+        ]
+      });
+      o0.close();
+    }
+  </script>
+</head>
+
+<body onload="start()">
+</body>
+</html>
diff --git a/dom/media/tests/crashtests/861958.html b/dom/media/tests/crashtests/861958.html
new file mode 100644
index 0000000000..d6ea7e2e84
--- /dev/null
+++ b/dom/media/tests/crashtests/861958.html
@@ -0,0 +1,24 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=861958
+-->
+<head>
+  <meta charset="utf-8">
+  <title>bug 861958</title>
+  <script type="application/javascript">
+    function start() {
+      var o0 = new window.RTCPeerConnection();
+      var o1 = o0.createDataChannel("foo", {
+          "protocol": "text/char",
+          "preset": false,
+          "stream": 512
+      });
+      o0.close();
+    }
+  </script>
+</head>
+
+<body onload="start()">
+</body>
+</html>
diff --git a/dom/media/tests/crashtests/863929.html b/dom/media/tests/crashtests/863929.html
new file mode 100644
index 0000000000..dc534e264f
--- /dev/null
+++ b/dom/media/tests/crashtests/863929.html
@@ -0,0 +1,66 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=863929
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Bug 863929</title>
+  <script type="application/javascript">
+    var pc1, pc2, pc1_offer, pc2_answer;
+
+    function onFailure(code) {
+        stop();
+    }
+
+    function stop() {
+      pc1.close();
+      pc1 = null;
+      pc2.close();
+      pc2 = null;
+      document.documentElement.removeAttribute("class");
+    }
+
+    function step1(offer) {
+      pc1_offer = offer;
+      pc1_offer.sdp = 'v=0\r\no=Mozilla-SIPUA 2208 0 IN IP4 0.0.0.0\r\ns=SIP Call\r\nt=0 0\r\na=ice-ufrag:96e36277\r\na=ice-pwd:4450d5a4a5f097855c16fa079893be18\r\na=fingerprint:sha-256 23:9A:2E:43:94:42:CF:46:68:FC:62:F9:F4:48:61:DB:2F:8C:C9:FF:6B:25:54:9D:41:09:EF:83:A8:19:FC:B6\r\nm=audio 56187 RTP/SAVPF 109 0 8 101\r\nc=IN IP4 77.9.79.167\r\na=rtpmap:109 opus/48000/2\r\na=ptime:20\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-15\r\na=sendrecv\r\na=candidate:0 1 UDP 2113601791 192.168.178.20 56187 typ host\r\na=candidate:1 1 UDP 1694236671 77.9.79.167 56187 typ srflx raddr 192.168.178.20 rport 56187\r\na=candidate:0 2 UDP 2113601790 192.168.178.20 52955 typ host\r\na=candidate:1 2 UDP 1694236670 77.9.79.167 52955 typ srflx raddr 192.168.178.20 rport 52955\r\nm=video 49929 RTP/SAVPF 120\r\nc=IN IP4 77.9.79.167\r\na=rtpmap:120 telephone-event/90000\r\na=recvonly\r\na=candidate:0 1 UDP 2113601791 192.168.178.20 49929 typ host\r\na=candidate:1 1 UDP 1694236671 77.9.79.167 49929 typ srflx raddr 192.168.178.20 rport 49929\r\na=candidate:0 2 UDP 2113601790 192.168.178.20 50769 typ host\r\na=candidate:1 2 UDP 1694236670 77.9.79.167 50769 typ srflx raddr 192.168.178.20 rport 50769\r\nm=application 54054 SCTP/DTLS 5000 \r\nc=IN IP4 77.9.79.167\r\na=fmtp:5000 protocol=webrtc-datachannel;streams=16\r\na=sendrecv\r\n';
+      pc1.setLocalDescription(pc1_offer, step2, onFailure);
+    }
+
+    function step2() {
+      pc2.setRemoteDescription(pc1_offer, step3, onFailure);
+    }
+
+    function step3() {
+      pc2.createAnswer(step4, onFailure);
+    }
+
+    function step4(answer) {
+      pc2_answer = answer;
+      pc2.setLocalDescription(pc2_answer, step5, onFailure);
+    }
+
+    function step5() {
+      pc1.setRemoteDescription(pc2_answer, step6, onFailure);
+    }
+
+    function step6() {
+      stop();
+    }
+
+    function start() {
+      pc1 = new RTCPeerConnection();
+      pc2 = new RTCPeerConnection();
+      navigator.mozGetUserMedia({audio:true, video:true, fake:true}, function(s) {
+        pc1.addStream(s);
+          navigator.mozGetUserMedia({audio:true, video:true, fake:true}, function(s) {
+            pc2.addStream(s);
+            pc1.createOffer(step1, onFailure);
+        }, onFailure);
+      }, onFailure);
+    }
+  </script>
+</head>
+
+<body onload="start()">
+</html>
diff --git a/dom/media/tests/crashtests/crashtests.list b/dom/media/tests/crashtests/crashtests.list
new file mode 100644
index 0000000000..c18d288aa1
--- /dev/null
+++ b/dom/media/tests/crashtests/crashtests.list
@@ -0,0 +1,42 @@
+defaults pref(media.peerconnection.enabled,true) pref(media.navigator.permission.disabled,true) pref(dom.disable_open_during_load,false) pref(media.devices.insecure.enabled,true) pref(media.getusermedia.insecure.enabled,true)
+
+load 780790.html
+load 791270.html
+load 791278.html
+load 791330.html
+load 799419.html
+load 802982.html
+skip-if(isDebugBuild) load 812785.html
+load 834100.html
+load 836349.html
+load 837324.html
+load 855796.html
+load 860143.html
+load 861958.html
+load 863929.html
+load 1281695.html
+load 1306476.html
+load 1348381.html
+load 1367930_1.html
+load 1367930_2.html
+skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) asserts-if(Android,0-1) pref(browser.link.open_newwindow,2) load 1429507_1.html # window.open() in tab doesn't work for crashtest in e10s, this opens a new window instead
+skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) asserts-if(Android,0-1) pref(browser.link.open_newwindow,2) load 1429507_2.html # window.open() in tab doesn't work for crashtest in e10s, this opens a new window instead
+load 1443212.html
+skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) asserts-if(Android,0-2) load 1453030.html
+load 1468451.html
+skip-if(Android|/^Windows\x20NT\x206\.1/.test(http.oscpu)) load 1490700.html # No screenshare on Android
+skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) load 1505957.html
+load 1509442.html
+load 1511130.html
+load 1510848.html
+load 1516292.html
+load 1576938.html
+skip-if(Android) pref(media.getusermedia.audiocapture.enabled,true) load 1573536.html
+skip-if(!Android) pref(media.getusermedia.audiocapture.enabled,true) pref(media.navigator.permission.device,false) load 1573536.html # media.navigator.permission.device is mobile-only, so other platforms fail to set it (Bug 1350948)
+load 1594136.html
+load 1749308.html
+load 1764915.html
+load 1764933.html
+load 1764940.html
+load 1766668.html
+load 1783765.html
diff --git a/dom/media/tests/crashtests/datachannel-oom.html b/dom/media/tests/crashtests/datachannel-oom.html
new file mode 100644
index 0000000000..e55ec651be
--- /dev/null
+++ b/dom/media/tests/crashtests/datachannel-oom.html
@@ -0,0 +1,22 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title></title>
+  <script type="application/javascript">
+    function start() {
+      var size = 2147483638;
+      new RTCPeerConnection().createDataChannel('a').send(new Uint8Array(size));
+      var a = "a";
+      var count = Math.floor(Math.log2(size)) - 1;
+      for (var i = 0; i < count; i++) {
+        a += a;
+      }
+      new RTCPeerConnection().createDataChannel('a').send(a)
+    }
+  </script>
+</head>
+
+<body onload="start()">
+</body>
+</html>
-- 
cgit v1.2.3