summaryrefslogtreecommitdiffstats
path: root/layout/painting/crashtests
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--layout/painting/crashtests/1402183-1.html20
-rw-r--r--layout/painting/crashtests/1405881-1.html24
-rw-r--r--layout/painting/crashtests/1407470-1.html19
-rw-r--r--layout/painting/crashtests/1413073-1.html15
-rw-r--r--layout/painting/crashtests/1413073-2.html18
-rw-r--r--layout/painting/crashtests/1418177-1.html34
-rw-r--r--layout/painting/crashtests/1418722-1.html17
-rw-r--r--layout/painting/crashtests/1419917.html15
-rw-r--r--layout/painting/crashtests/1425271-1.html54
-rw-r--r--layout/painting/crashtests/1428906-1.html16
-rw-r--r--layout/painting/crashtests/1430589-1.html55
-rw-r--r--layout/painting/crashtests/1454105-1.html22
-rw-r--r--layout/painting/crashtests/1455944-1.html14
-rw-r--r--layout/painting/crashtests/1458145.html11
-rw-r--r--layout/painting/crashtests/1465305-1.html8
-rw-r--r--layout/painting/crashtests/1468124-1.html27
-rw-r--r--layout/painting/crashtests/1469472.html7
-rw-r--r--layout/painting/crashtests/1477831-1.html11
-rw-r--r--layout/painting/crashtests/1504033.html13
-rw-r--r--layout/painting/crashtests/1514544-1.html15
-rw-r--r--layout/painting/crashtests/1547420-1.html20
-rw-r--r--layout/painting/crashtests/1549909.html9
-rw-r--r--layout/painting/crashtests/1551389-1.html6
-rw-r--r--layout/painting/crashtests/1555819-1.html12
-rw-r--r--layout/painting/crashtests/1574392.html1
-rw-r--r--layout/painting/crashtests/1589800-1.html47
-rw-r--r--layout/painting/crashtests/1667503-1.html16
-rw-r--r--layout/painting/crashtests/1713880-1.html10
-rw-r--r--layout/painting/crashtests/1714584-1.html5
-rw-r--r--layout/painting/crashtests/1717655-1.html19
-rw-r--r--layout/painting/crashtests/1763006-1.html23
-rw-r--r--layout/painting/crashtests/1819957-1.html14
-rw-r--r--layout/painting/crashtests/crashtests.list32
33 files changed, 629 insertions, 0 deletions
diff --git a/layout/painting/crashtests/1402183-1.html b/layout/painting/crashtests/1402183-1.html
new file mode 100644
index 0000000000..ea54512894
--- /dev/null
+++ b/layout/painting/crashtests/1402183-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Bug 1402183</title>
+<style type="text/css">
+:not(article) {
+ -webkit-text-stroke-width: 1px;
+ box-decoration-break: clone;
+ clip-path: polygon(69px 1px, 49px 1px, 0px 0px);
+}
+</style>
+</head>
+<body>
+<ins>
+<p>
+r6O#i/q]
+</p>
+</ins>
+</body>
+</html>
diff --git a/layout/painting/crashtests/1405881-1.html b/layout/painting/crashtests/1405881-1.html
new file mode 100644
index 0000000000..44c8ab1ac0
--- /dev/null
+++ b/layout/painting/crashtests/1405881-1.html
@@ -0,0 +1,24 @@
+<style type="text/css">
+ #container {
+ height: 300px;
+ width: 300px;
+ }
+ #box {
+ height: 100px;
+ width: 100px;
+ background: red;
+ animation: 2s anim;
+ }
+ @keyframes anim {
+ from {
+ -moz-transform: matrix3d(1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 10%, 10%, 0, 1);
+ }
+ to {
+ -moz-transform: matrix3d(1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 40%, 40%, 0, 1);
+ }
+ }
+
+</style>
+<div id=container>
+ <div id=box></div>
+</div>
diff --git a/layout/painting/crashtests/1407470-1.html b/layout/painting/crashtests/1407470-1.html
new file mode 100644
index 0000000000..0ddf957182
--- /dev/null
+++ b/layout/painting/crashtests/1407470-1.html
@@ -0,0 +1,19 @@
+<body id='test_body'>
+<script>
+let o = [];
+o[0] = document.createElement("tt");
+test_body.appendChild(o[0]);
+o[1] = document.createElement("center");
+o[2] = document.createElement("footer");
+o[0].appendChild(o[2]);
+o[1].animate([{
+ "padding": "80.40vw 0.0vmax",
+ "transform": "matrix(6287.56,268.76,237.34,222.80,186.72,287.94) rotateX(2.046rad)"
+ }], { duration:3845.75 });
+o[2].appendChild(o[1]);
+test_body.animate([{
+ "transform": "scale3d(0.0,5961462.820,250.41)",
+ "outline": "auto thick",
+ "mask": "exclude no-clip url(data:image/gif;base64,R0lGODlhAQABAAD/ACH/C05FVFNDQVBFMi4wAwEAAAAsAAAAAAEAAQAAAgAsAAAAAAEAAQAAAgA7),exclude",
+ }], 3617.63433129);
+</script> \ No newline at end of file
diff --git a/layout/painting/crashtests/1413073-1.html b/layout/painting/crashtests/1413073-1.html
new file mode 100644
index 0000000000..ddecfb2424
--- /dev/null
+++ b/layout/painting/crashtests/1413073-1.html
@@ -0,0 +1,15 @@
+<html class="reftest-wait">
+<body>
+<div style="position:fixed; width:200px; height:200px; background-color:blue">
+ <div style="position:fixed; width:200px; height:200px; left:400px; background-color:red" id="inner"></div>
+</div>
+</body>
+<script>
+ function doTest() {
+ var d = document.getElementById("inner");
+ d.style.backgroundColor = "green";
+ document.documentElement.className = "";
+ }
+ window.addEventListener("MozReftestInvalidate", doTest);
+</script>
+</html>
diff --git a/layout/painting/crashtests/1413073-2.html b/layout/painting/crashtests/1413073-2.html
new file mode 100644
index 0000000000..01d1718745
--- /dev/null
+++ b/layout/painting/crashtests/1413073-2.html
@@ -0,0 +1,18 @@
+<html class="reftest-wait">
+<body>
+<div style="position:absolute; width:200px; height:200px; opacity:0.5">
+ <div style="opacity:0.9">
+ <div style="position:fixed; width:200px; height:200px; left:400px; background-color:blue" id="fixed"></div>
+ </div>
+ <div style="width:200px; height:200px; background-color:red" id="inner"></div>
+</div>
+</body>
+<script>
+ function doTest() {
+ var d = document.getElementById("inner");
+ d.style.backgroundColor = "green";
+ document.documentElement.className = "";
+ }
+ window.addEventListener("MozReftestInvalidate", doTest);
+</script>
+</html>
diff --git a/layout/painting/crashtests/1418177-1.html b/layout/painting/crashtests/1418177-1.html
new file mode 100644
index 0000000000..6420814bce
--- /dev/null
+++ b/layout/painting/crashtests/1418177-1.html
@@ -0,0 +1,34 @@
+<html>
+ <head>
+ <style>
+ * {
+ background: url(16.png), url(16.png) transparent;
+ -webkit-background-clip: text, text;
+ -moz-tab-size: calc(1 + 1) !important;
+ background-blend-mode: screen;
+ align-content: baseline;
+ background-color: green;
+ }
+ </style>
+ <script>
+ function fun_0() {
+ try { o3 = document.createElement('th') } catch (e) {};
+ try { o1.appendChild(o3) } catch (e) {}
+ }
+
+ try { o1 = document.createElement('tr') } catch (e) {}
+ try { o2 = document.createElement('ol') } catch (e) {}
+ try { xhr = new XMLHttpRequest({mozAnon: false }) } catch (e) {}
+ try { document.documentElement.appendChild(o1) } catch (e) {}
+ try { document.documentElement.appendChild(o2) } catch (e) {}
+ for (let i = 0; i < 100; i++) {
+ try { xhr.open('GET', 'data:text/html,1', false); } catch (e) {};
+ try { xhr.send(); } catch (e) {};
+ try { fuzzPriv.GC(); fuzzPriv.CC(); fuzzPriv.GC(); fuzzPriv.CC(); } catch (e) {};
+ try { xhr.addEventListener('readystatechange', fun_0, true) } catch (e) {};
+ try { o2.offsetLeft } catch (e) {};
+ try { document.styleSheets[0].cssRules[0].style['background-origin'] = 'border-box, border-box' } catch (e) {}
+ }
+ </script>
+ </head>
+</html>
diff --git a/layout/painting/crashtests/1418722-1.html b/layout/painting/crashtests/1418722-1.html
new file mode 100644
index 0000000000..93415d3012
--- /dev/null
+++ b/layout/painting/crashtests/1418722-1.html
@@ -0,0 +1,17 @@
+<html class="reftest-wait">
+<body>
+ <div style="width:200px; height:200px; perspective:1000px">
+ <div style="width:200px; height:200px; transform:translateZ(2px); background-color:green" id="transformed"></div>
+ </div>
+ <div style="width: 200px; height:200px; background-color:red" id="helper"></div>
+</body>
+<script>
+ function doTest() {
+ var element = document.getElementById("transformed");
+ element.parentNode.removeChild(element);
+ document.getElementById("helper").style.backgroundColor = "blue";
+ document.documentElement.className = "";
+ }
+ window.addEventListener("MozReftestInvalidate", doTest);
+</script>
+</html>
diff --git a/layout/painting/crashtests/1419917.html b/layout/painting/crashtests/1419917.html
new file mode 100644
index 0000000000..a60dd15403
--- /dev/null
+++ b/layout/painting/crashtests/1419917.html
@@ -0,0 +1,15 @@
+<html>
+ <head>
+ <style>
+ :nth-last-child(2) { -moz-appearance:listbox }
+ </style>
+ <script>
+ try { o1 = document.createElement('tr') } catch(e) { }
+ try { o2 = document.createElement('th') } catch(e) { }
+ try { o3 = document.createElement('canvas') } catch(e) { }
+ try { document.documentElement.appendChild(o1) } catch(e) { }
+ try { o1.appendChild(o2) } catch(e) { }
+ try { o1.appendChild(o3) } catch(e) { }
+ </script>
+ </head>
+</html>
diff --git a/layout/painting/crashtests/1425271-1.html b/layout/painting/crashtests/1425271-1.html
new file mode 100644
index 0000000000..164cb0f11f
--- /dev/null
+++ b/layout/painting/crashtests/1425271-1.html
@@ -0,0 +1,54 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+
+<head>
+ <meta http-equiv="content-type" content="text/html; charset=UTF-8">
+ <meta charset="utf-8">
+</head>
+
+<body>
+<div id="container">
+ <div id="element">
+ <!--
+ The HTML code for this element has no other meaning than to create
+ display items that are merged together.
+ -->
+ <div style="column-count:2; column-count:2; width:300px; height:100px;">
+ <div id="o" style="opacity:0.5; width:100px; height:200px; background:lime;">
+ <div id="d" style="height:50px; width:80px; background:red; padding:2px">Text</div>
+ </div>
+ </div>
+ </div>
+</div>
+
+<script type="text/javascript">
+function redirect() {
+ document.documentElement.removeAttribute("class");
+
+ // Trigger root frame deletion.
+ window.location.replace("about:blank");
+}
+
+function removeElements(container) {
+ document.body.removeChild(container);
+
+ setTimeout(redirect, 0);
+}
+
+function createElements() {
+ var c = document.getElementById("container");
+ var e = document.getElementById("element");
+ for (var i = 0; i < 1000; ++i) {
+ // Populate the container with elements that cause display item merges.
+ c.appendChild(e.cloneNode(true));
+ }
+
+ setTimeout(() => removeElements(c), 0);
+}
+
+document.addEventListener("MozReftestInvalidate", createElements);
+// window.addEventListener("load", createElements);
+</script>
+
+</body>
+</html>
diff --git a/layout/painting/crashtests/1428906-1.html b/layout/painting/crashtests/1428906-1.html
new file mode 100644
index 0000000000..03e6d3aaf8
--- /dev/null
+++ b/layout/painting/crashtests/1428906-1.html
@@ -0,0 +1,16 @@
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8"><style>
+*,m{background:url()repeat center top fixed}
+#a{transform:scale(1)}
+</style>
+<script>
+function eh1(){
+ try{c=a.insertRow()}catch(e){}
+ try{c.appendChild(b)}catch(e){}
+}
+</script>
+</head><body><table id="a">
+<tbody><tr><d id="b">
+<video>
+<source onerror="eh1()">
+</video></d></tr></tbody></table></body></html>
diff --git a/layout/painting/crashtests/1430589-1.html b/layout/painting/crashtests/1430589-1.html
new file mode 100644
index 0000000000..88bb0494a7
--- /dev/null
+++ b/layout/painting/crashtests/1430589-1.html
@@ -0,0 +1,55 @@
+<html class="reftest-wait"><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+ <style>
+ :root {
+ flex-wrap: wrap-reverse;
+ }
+ menuitem {
+ -webkit-mask-image: url(data:image/gif;base64,R0lGODlhEAAQAMQAAORHHOVSKudfOulrSOp3WOyDZu6QdvCchPGolfO0o/XBs/fNwfjZ0frl3/zy7////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAkAABAALAAAAAAQABAAAAVVICSOZGlCQAosJ6mu7fiyZeKqNKToQGDsM8hBADgUXoGAiqhSvp5QAnQKGIgUhwFUYLCVDFCrKUE1lBavAViFIDlTImbKC5Gm2hB0SlBCBMQiB0UjIQA7);
+ }
+
+ * {
+ margin-right: -1px;
+ display: -webkit-box;
+ overflow: scroll;
+ }
+
+
+ .css1 {
+ -webkit-border-bottom-left-radius: 10px;
+ }
+
+
+ </style>
+<script>
+function BOOM(){
+ setTimeout(() => {
+ var elem = document.getElementById("vuln");
+ elem.style.width = 600;
+ elem.style.height = 600;
+ window.requestAnimationFrame(() => {
+ window.requestAnimationFrame(() => {
+ document.documentElement.removeAttribute("class");
+ });
+ });
+ }, 0);
+}
+
+document.addEventListener("MozReftestInvalidate", BOOM);
+//window.addEventListener("load", BOOM);
+</script></head>
+
+<body>
+ <footer>
+ <textarea id="vuln" style="width: 500px; height: 500px;">Ashitaka</textarea>
+ </footer>
+ <menu>
+ <menuitem>
+ <iframe></iframe>
+ </menuitem></menu>
+ <menuitem>
+ <hr>
+ <dialog class="css1"></dialog>
+
+
+</menuitem></body></html>
diff --git a/layout/painting/crashtests/1454105-1.html b/layout/painting/crashtests/1454105-1.html
new file mode 100644
index 0000000000..946d45992b
--- /dev/null
+++ b/layout/painting/crashtests/1454105-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<style>
+#a {
+ filter: brightness(1);
+ border-style: solid;
+}
+#b {
+ opacity: 0.2;
+}
+</style>
+</head>
+<body>
+<span id="b">
+ <span id="a">
+ <div></div>
+ </span>
+</span>
+</body>
+</html>
diff --git a/layout/painting/crashtests/1455944-1.html b/layout/painting/crashtests/1455944-1.html
new file mode 100644
index 0000000000..c115f4dd8e
--- /dev/null
+++ b/layout/painting/crashtests/1455944-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+<meta charset="utf-8">
+</head>
+
+<body>
+<div style="opacity: 0.9;">
+ <iframe style="border: none;" src=""></iframe>
+</div>
+
+</body>
+</html>
diff --git a/layout/painting/crashtests/1458145.html b/layout/painting/crashtests/1458145.html
new file mode 100644
index 0000000000..dc5f07c204
--- /dev/null
+++ b/layout/painting/crashtests/1458145.html
@@ -0,0 +1,11 @@
+<style>
+* { position: fixed; }
+#a {
+perspective: 0px;
+overflow: scroll;
+}
+.cl2 { -webkit-transform-style: preserve-3d; }
+.cl1 { border-bottom-right-radius: 0px 1px; }
+</style>
+<del id="a" class="cl1">
+<dl class="cl2">#_k</dl>
diff --git a/layout/painting/crashtests/1465305-1.html b/layout/painting/crashtests/1465305-1.html
new file mode 100644
index 0000000000..084f524fba
--- /dev/null
+++ b/layout/painting/crashtests/1465305-1.html
@@ -0,0 +1,8 @@
+<style>
+:not(cursor) {
+ -webkit-background-clip: text;
+ border-top-right-radius: 0vh;
+}
+</style>
+><input>
+<dialog open="">
diff --git a/layout/painting/crashtests/1468124-1.html b/layout/painting/crashtests/1468124-1.html
new file mode 100644
index 0000000000..9acf1427db
--- /dev/null
+++ b/layout/painting/crashtests/1468124-1.html
@@ -0,0 +1,27 @@
+<html class="reftest-wait">
+<style>
+:not(feFuncB) {
+ position: fixed;
+}
+a:last-child {
+ -webkit-transform-style: preserve-3d;
+}
+* {
+ -webkit-backface-visibility: hidden;
+</style>
+<script>
+window.requestIdleCallback(function() {
+ document.documentElement.getBoundingClientRect();
+});
+function go() {
+ var c = document.createElement("a")
+ c.text = "-";
+ try { c.replaceChild(b, c.childNodes[0]); } catch(e) { }
+ try { document.body.appendChild(c); } catch(e) { }
+ document.documentElement.className = "";
+}
+</script>
+<body onload=go()>
+<d id="b">|
+<audio controls="">
+</html>
diff --git a/layout/painting/crashtests/1469472.html b/layout/painting/crashtests/1469472.html
new file mode 100644
index 0000000000..f53d027704
--- /dev/null
+++ b/layout/painting/crashtests/1469472.html
@@ -0,0 +1,7 @@
+<style>
+:not(polygon) {
+background-image: url(#x);
+background-blend-mode: hue, normal;
+</style>
+<table>
+<th>
diff --git a/layout/painting/crashtests/1477831-1.html b/layout/painting/crashtests/1477831-1.html
new file mode 100644
index 0000000000..d6483bde02
--- /dev/null
+++ b/layout/painting/crashtests/1477831-1.html
@@ -0,0 +1,11 @@
+<style>
+* {
+ margin-left: 1vw;
+ columns: 2;
+ opacity: 0.2;
+ -webkit-transform: rotate(0deg);
+}
+#a { float: left; }
+</style>
+<content id="a">
+<dd>A</dd>
diff --git a/layout/painting/crashtests/1504033.html b/layout/painting/crashtests/1504033.html
new file mode 100644
index 0000000000..9aeb7973be
--- /dev/null
+++ b/layout/painting/crashtests/1504033.html
@@ -0,0 +1,13 @@
+<style>
+* { -webkit-transform-style: preserve-3d }
+</style>
+<script>
+function go() {
+ a.append("x");
+}
+</script>
+<body onload=go()>
+<svg overflow="auto">
+<use xlink:href="#b" style="-webkit-transform-style: flat"/>
+<use id="b" xlink:href="#a">
+<text id="a">
diff --git a/layout/painting/crashtests/1514544-1.html b/layout/painting/crashtests/1514544-1.html
new file mode 100644
index 0000000000..8e9efdc3c4
--- /dev/null
+++ b/layout/painting/crashtests/1514544-1.html
@@ -0,0 +1,15 @@
+<html class="reftest-wait">
+<script>
+setTimeout(function() {
+ a.appendChild(b);
+ document.documentElement.className = "";
+}, 100)
+</script>
+<style>
+:root { opacity: 0 }
+</style>
+A
+<textarea id="a" hidden=""></textarea>
+<object id="b" >
+A
+</html>
diff --git a/layout/painting/crashtests/1547420-1.html b/layout/painting/crashtests/1547420-1.html
new file mode 100644
index 0000000000..ce54d67d09
--- /dev/null
+++ b/layout/painting/crashtests/1547420-1.html
@@ -0,0 +1,20 @@
+<script></script>
+<style>
+* {
+ text-align-last: right;
+ min-height: max-content;
+ min-width: 1vmin;
+ writing-mode: vertical-rl;
+}
+</style>
+<q style="writing-mode: lr">
+<marquee></marquee>
+<style></style>
+</q>
+<dl style="-webkit-transform: skew(0deg); mso-ignore: colspan">
+<dd>
+<table>
+<dt style="margin-left: 67%; scale: 7 46 0.006057077979">
+</dt>
+<marquee bgcolor="-moz-mac-accentdarkestshadow">
+<button autofocus="autofocus">
diff --git a/layout/painting/crashtests/1549909.html b/layout/painting/crashtests/1549909.html
new file mode 100644
index 0000000000..0542ee91a8
--- /dev/null
+++ b/layout/painting/crashtests/1549909.html
@@ -0,0 +1,9 @@
+<style>
+* {
+ -webkit-column-break-after: always;
+ float: left;
+ column-width: 0px;
+}
+</style>
+}
+<video controls="controls">
diff --git a/layout/painting/crashtests/1551389-1.html b/layout/painting/crashtests/1551389-1.html
new file mode 100644
index 0000000000..4ee12c1ce9
--- /dev/null
+++ b/layout/painting/crashtests/1551389-1.html
@@ -0,0 +1,6 @@
+<style>
+dl::first-letter { float: right }
+* { -webkit-box-shadow: -moz-cellhighlighttext 0px 34px 1px }
+</style>
+<s dir="RTL">
+<dl style="break-inside: avoid">AA</iframe>
diff --git a/layout/painting/crashtests/1555819-1.html b/layout/painting/crashtests/1555819-1.html
new file mode 100644
index 0000000000..0327e3690f
--- /dev/null
+++ b/layout/painting/crashtests/1555819-1.html
@@ -0,0 +1,12 @@
+<style>
+body {
+ width: 1px;
+ height: 5vmax;
+ -webkit-filter: brightness(1);
+}
+* {
+ grid-template-areas: '';
+ columns: 1px;
+}
+</style>
+<keygen autofocus="">aaaa
diff --git a/layout/painting/crashtests/1574392.html b/layout/painting/crashtests/1574392.html
new file mode 100644
index 0000000000..2e8c4d15aa
--- /dev/null
+++ b/layout/painting/crashtests/1574392.html
@@ -0,0 +1 @@
+<u>🏴󠁵󠁳󠁣󠁡󠁿</u>
diff --git a/layout/painting/crashtests/1589800-1.html b/layout/painting/crashtests/1589800-1.html
new file mode 100644
index 0000000000..8af28028a0
--- /dev/null
+++ b/layout/painting/crashtests/1589800-1.html
@@ -0,0 +1,47 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+ <meta http-equiv="content-type" content="text/html; charset=utf-8">
+ <style>
+ #parent {
+ transform: rotateZ(1deg);
+ position: absolute;
+ opacity: 0.5;
+ overflow-x: hidden;
+ }
+
+ #child {
+ width: 10px;
+ height: 10px;
+ }
+
+ .blend {
+ mix-blend-mode: color-burn;
+ }
+ </style>
+</head>
+
+<body>
+ <div id="parent">
+ <div id="child">a</div>
+ </div>
+ <div>
+ <div id="blend">a</div>
+ </div>
+ <script type="text/javascript">
+ function modify() {
+ var e = document.getElementById("child");
+ e.style.backgroundColor = "red";
+ setTimeout(addBlend, 0);
+ }
+
+ function addBlend() {
+ var e = document.getElementById("blend");
+ e.classList.add("blend");
+ }
+
+ // setTimeout(modify, 3000);
+ window.addEventListener("MozAfterPaint", modify);
+ </script>
+</body>
+</html>
diff --git a/layout/painting/crashtests/1667503-1.html b/layout/painting/crashtests/1667503-1.html
new file mode 100644
index 0000000000..70f99b3f37
--- /dev/null
+++ b/layout/painting/crashtests/1667503-1.html
@@ -0,0 +1,16 @@
+<script>
+function go() {
+ b.src = "x:"
+ b.requestFullscreen()
+}
+function fuzz() {
+ a.close("")
+ b.src = "x"
+ a.showModal()
+ a.appendChild(document.createElement("b"))
+}
+</script>
+<body onload=go()>
+<dialog id="a">
+<nav>x</nav>
+<video id="b" onerror="fuzz()"></video>
diff --git a/layout/painting/crashtests/1713880-1.html b/layout/painting/crashtests/1713880-1.html
new file mode 100644
index 0000000000..1ccd59743a
--- /dev/null
+++ b/layout/painting/crashtests/1713880-1.html
@@ -0,0 +1,10 @@
+<script>
+window.onload = () => {
+ let a = document.createElement("dt")
+ c.appendChild(a)
+ let b = document.createElement("button")
+ a.appendChild(b)
+ b.animate([{"all": "revert"}], {delay: 9.04})
+}
+</script>
+<body id='c'></body>
diff --git a/layout/painting/crashtests/1714584-1.html b/layout/painting/crashtests/1714584-1.html
new file mode 100644
index 0000000000..1ef2812a2d
--- /dev/null
+++ b/layout/painting/crashtests/1714584-1.html
@@ -0,0 +1,5 @@
+<style>
+output:only-of-type { opacity: 0 }
+</style>
+<output>
+<iframe src="x">x</iframe>
diff --git a/layout/painting/crashtests/1717655-1.html b/layout/painting/crashtests/1717655-1.html
new file mode 100644
index 0000000000..940dac6dfb
--- /dev/null
+++ b/layout/painting/crashtests/1717655-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <style>
+ * {
+ transform: perspective(2337713741.755817Q) !important;
+ height: 2637992280%;
+ }
+
+ * {
+ border-width: medium;
+ display: table;
+ }
+ </style>
+</head>
+<table border="32767" rules="all">
+ <caption></caption>
+</table>
+</html>
diff --git a/layout/painting/crashtests/1763006-1.html b/layout/painting/crashtests/1763006-1.html
new file mode 100644
index 0000000000..080c88e7d8
--- /dev/null
+++ b/layout/painting/crashtests/1763006-1.html
@@ -0,0 +1,23 @@
+<style>
+#a {
+ -webkit-filter: invert(10%);
+ background: url(data:image/gif;base64,R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs=) repeat-x center top fixed
+}
+</style>
+<script>
+function go() {
+ window.find("1")
+ requestIdleCallback(() => {
+ a.insertCell().appendChild(b)
+ var x = window.getSelection()
+ x.extend(b)
+ x.deleteFromDocument()
+ })
+}
+</script>
+<body onload=go()>
+<table>
+<colgroup>Z1xNfp~Zdx</colgroup>
+<tr id="a">
+<th></th>
+<li id="b">
diff --git a/layout/painting/crashtests/1819957-1.html b/layout/painting/crashtests/1819957-1.html
new file mode 100644
index 0000000000..647c9b7f12
--- /dev/null
+++ b/layout/painting/crashtests/1819957-1.html
@@ -0,0 +1,14 @@
+<style>
+::selection {
+ text-shadow: 0 1px 0px -moz-mac-menushadow;
+}
+</style>
+<script>
+document.addEventListener('DOMContentLoaded', () => {
+ document.execCommand("selectAll", false)
+})
+</script>
+<dir>
+<menu id="foo"></menu>
+<menu>
+<link>a</link>
diff --git a/layout/painting/crashtests/crashtests.list b/layout/painting/crashtests/crashtests.list
new file mode 100644
index 0000000000..7bc56b335c
--- /dev/null
+++ b/layout/painting/crashtests/crashtests.list
@@ -0,0 +1,32 @@
+load 1402183-1.html
+load 1407470-1.html
+load 1413073-1.html
+load 1413073-2.html
+load 1405881-1.html
+load 1418177-1.html
+load 1418722-1.html
+load 1419917.html
+load 1425271-1.html
+load 1428906-1.html
+pref(widget.windows.window_occlusion_tracking.enabled,false) load 1430589-1.html # Bug 1819154
+load 1454105-1.html
+load 1455944-1.html
+load 1458145.html
+load 1465305-1.html
+load 1468124-1.html
+load 1469472.html
+load 1477831-1.html
+load 1504033.html
+load 1514544-1.html
+asserts(0-1) asserts-if(Android,0-2) load 1547420-1.html
+load 1549909.html
+load 1551389-1.html
+asserts(0-2) load 1555819-1.html
+load 1574392.html
+load 1589800-1.html
+load 1667503-1.html
+load 1713880-1.html
+load 1717655-1.html
+load 1714584-1.html
+load 1763006-1.html
+load 1819957-1.html