7 files changed, 65 insertions, 0 deletions
diff --git a/netwerk/test/crashtests/1274044-1.html b/netwerk/test/crashtests/1274044-1.html
new file mode 100644
index 0000000000..cb88e50bcd
--- /dev/null
+++ b/netwerk/test/crashtests/1274044-1.html
@@ -0,0 +1,7 @@
+<script>
+
+var u = new URL("http://127.0.0.1:9607/");
+u.protocol = "resource:";
+u.port = "";
+
+</script>
diff --git a/netwerk/test/crashtests/1334468-1.html b/netwerk/test/crashtests/1334468-1.html
new file mode 100644
index 0000000000..3d94d69949
--- /dev/null
+++ b/netwerk/test/crashtests/1334468-1.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<!--
+user_pref("privacy.firstparty.isolate", true);
+-->
+<script>
+
+let RESTRICTED_CHARS = "\001\002\003\004\005\006\007" +
+                       "\010\011\012\013\014\015\016\017" +
+                       "\020\021\022\023\024\025\026\027" +
+                       "\030\031\032\033\034\035\036\037" +
+                       "/:*?\"<>|\\";
+
+function boom() {
+  for (let c of RESTRICTED_CHARS) {
+    window.location = 'http://s.s' + c;
+  }
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/netwerk/test/crashtests/1399467-1.html b/netwerk/test/crashtests/1399467-1.html
new file mode 100644
index 0000000000..7d16e119d0
--- /dev/null
+++ b/netwerk/test/crashtests/1399467-1.html
@@ -0,0 +1 @@
+<script src='ftp:%'>
diff --git a/netwerk/test/crashtests/1793521.html b/netwerk/test/crashtests/1793521.html
new file mode 100644
index 0000000000..5bd19df01d
--- /dev/null
+++ b/netwerk/test/crashtests/1793521.html
@@ -0,0 +1 @@
+<iframe src='http://&#xD49&#x44&#x2D'></iframe>
diff --git a/netwerk/test/crashtests/675518.html b/netwerk/test/crashtests/675518.html
new file mode 100644
index 0000000000..44a43570e4
--- /dev/null
+++ b/netwerk/test/crashtests/675518.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<script>
+function boom()
+{
+  var frame = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+  frame.src = "javascript:'<html><body>1</body></html>';";
+  document.body.appendChild(frame);
+  var frameWin = frame.contentWindow;
+
+  var resizeListener = function() {
+    frameWin.removeEventListener("resize", resizeListener, false);
+    frameWin.document.write("3...");
+  };
+  frameWin.addEventListener("resize", resizeListener, false);
+
+  frameWin.document.write("2...");
+}
+
+</script>
+<body onload="boom();"></body>
+</html>
diff --git a/netwerk/test/crashtests/785753-2.html b/netwerk/test/crashtests/785753-2.html
new file mode 100644
index 0000000000..15a9865388
--- /dev/null
+++ b/netwerk/test/crashtests/785753-2.html
@@ -0,0 +1,3 @@
+<link rel="stylesheet" href="data:text/css;charset=utf-16,a"/>
+
+<link rel="stylesheet" href="data:text/css;charset=utf-16,p#two%1%7Bbackground-color%65535A%4294967297lime%3B%7D%0D%0A"/>
+\ No newline at end of file
diff --git a/netwerk/test/crashtests/crashtests.list b/netwerk/test/crashtests/crashtests.list
new file mode 100644
index 0000000000..01ffacd8e3
--- /dev/null
+++ b/netwerk/test/crashtests/crashtests.list
@@ -0,0 +1,7 @@
+skip load 675518.html
+load 785753-1.html
+load 785753-2.html
+load 1274044-1.html
+skip-if(ThreadSanitizer) skip-if(Android) pref(privacy.firstparty.isolate,true) load 1334468-1.html # Bug 1639080
+load 1399467-1.html
+load 1793521.html