6 files changed, 115 insertions, 0 deletions
diff --git a/dom/media/webvtt/test/crashtests/1304948.html b/dom/media/webvtt/test/crashtests/1304948.html
new file mode 100644
index 0000000000..667a13d06a
--- /dev/null
+++ b/dom/media/webvtt/test/crashtests/1304948.html
@@ -0,0 +1,33 @@
+<html class="reftest-wait">
+<head>
+  <title> Bug 1304948 : Crash if a texttrack remove a cue not belongs to it. </title>
+</head>
+<meta charset="utf-8">
+<script type="text/javascript">
+
+window.onload = function() {
+  var a = document.createElementNS('http://www.w3.org/1999/xhtml', 'video');
+  a.src = "";
+  document.body.appendChild(a);
+  var b = a.addTextTrack('chapters', "AAAAAAAAAAAAAAAA", "de");
+  var c = new VTTCue(0.6, 0.3, "AA");
+  b.addCue(c);
+  var d = document.createElementNS('http://www.w3.org/1999/xhtml', 'video');
+  var e = d.addTextTrack('chapters', "AAAA", "en-US");
+  a.currentTime = 2;
+  a.play();
+  try {
+    // This will queue a TimeMarchesOn task on mainthread, so use
+    // timer to wait the TimeMarchesOn crash.
+    e.removeCue(c);
+  } catch (e) {
+    if (e.name == "NotFoundError") {
+      setTimeout(function() {
+        document.documentElement.removeAttribute("class");}, 0);
+	  }
+  }
+};
+
+</script>
+</body>
+</html>
diff --git a/dom/media/webvtt/test/crashtests/1319486.html b/dom/media/webvtt/test/crashtests/1319486.html
new file mode 100644
index 0000000000..74bdb2147c
--- /dev/null
+++ b/dom/media/webvtt/test/crashtests/1319486.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title> Bug 1319486 : Crash if a texttrackcue added to different texttracks. </title>
+</head>
+<body>
+<video id=v1></video>
+<video id=v2></video>
+</body>
+<meta charset="utf-8">
+<script type="text/javascript">
+
+addEventListener('DOMContentLoaded', function(){
+  let cue,tt1,tt2;
+  v1.play();
+  tt1 = v1.addTextTrack('metadata', "", "");
+  v1.play();
+  v1.currentTime = 8;
+  cue = new VTTCue(0, 0.5, "");
+  tt1.addCue(cue);
+  tt2 = v2.addTextTrack('captions', "", "");
+  tt2.addCue(cue);
+  tt2.removeCue(cue);
+  tt1.addCue(new VTTCue(0.7, 2, ""));
+});
+</script>
+</html>
diff --git a/dom/media/webvtt/test/crashtests/1533909.html b/dom/media/webvtt/test/crashtests/1533909.html
new file mode 100644
index 0000000000..ee73ecb7b8
--- /dev/null
+++ b/dom/media/webvtt/test/crashtests/1533909.html
@@ -0,0 +1,17 @@
+<script>
+function eh1() {
+  d.track.addCue(new VTTCue(0.01, 0.69, "Y"))
+}
+function eh2() {
+  a.currentTime = 0.43
+  c.addEventListener("DOMNodeRemoved", eh1)
+  a.append(b)
+  a.appendChild(c)
+}
+</script>
+<canvas id="c">
+<q id="b">
+</canvas>
+<audio id="a" src="data:audio/mpeg;base64,/+M4wAAAAAAAAAAAAEluZm8AAAAPAAAAAwAAAbAAqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV////////////////////////////////////////////AAAAAExhdmM1Ny4zOAAAAAAAAAAAAAAAACQAAAAAAAAAAAGwU/hwzwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/+MYxAAMkI7huAhMDGQAndv+H5jfIAPmPzGBGeTAZNN7yjsnqd6Fny79M+o4UifnMu/TlDiIP5Q5l9Z/Kdv6VY0gE3JIAAwE/+MYxAgMYJr6WBhGIivjMy/CEK+zM39VVXjMArKgq6DQdrBV0THlqBp0ShrBp8qGsTPw7lXZFVZZY6GytZZYGChgYIGZaiJI/+MYxBEMUJnAABmMYUigMQLIE1yVpphA1UQMRVVVV000iVu000VVVX///6aaVUxBTUUzLjk5LjVVVVVVVVVVVVVVVVVVVVVV">
+<track id="d"></track>
+<iframe onload="eh2()">
diff --git a/dom/media/webvtt/test/crashtests/882549.html b/dom/media/webvtt/test/crashtests/882549.html
new file mode 100644
index 0000000000..8a720c3e11
--- /dev/null
+++ b/dom/media/webvtt/test/crashtests/882549.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+    <head>
+        <script>
+            var o0 = new VTTCue(0.000, 1.000, 'Bug882549');
+            var o1 = o0.getCueAsHTML();
+        </script>
+    </head>
+    <body>
+    </body>
+</html>
+<script>
+</script>
diff --git a/dom/media/webvtt/test/crashtests/894104.html b/dom/media/webvtt/test/crashtests/894104.html
new file mode 100644
index 0000000000..d021994e74
--- /dev/null
+++ b/dom/media/webvtt/test/crashtests/894104.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+  var frame = document.getElementById("f");
+  var frameWin = frame.contentWindow;
+  frameWin.VTTCue;
+  document.body.removeChild(frame);
+  new frameWin.VTTCue(0, 1, "Bug 894104").getCueAsHTML();
+}
+
+</script>
+</head>
+
+<body onload="boom();"><iframe id="f" src="data:text/html,1"></iframe></body>
+</html>
diff --git a/dom/media/webvtt/test/crashtests/crashtests.list b/dom/media/webvtt/test/crashtests/crashtests.list
new file mode 100644
index 0000000000..c9776984bc
--- /dev/null
+++ b/dom/media/webvtt/test/crashtests/crashtests.list
@@ -0,0 +1,5 @@
+load 1304948.html
+load 1319486.html
+load 1533909.html
+load 882549.html
+load 894104.html