summaryrefslogtreecommitdiffstats
path: root/image/test/crashtests
diff options
context:
space:
mode:
authorMatt A. Tobin <mattatobin@localhost.localdomain>2018-02-02 04:16:08 -0500
committerMatt A. Tobin <mattatobin@localhost.localdomain>2018-02-02 04:16:08 -0500
commit5f8de423f190bbb79a62f804151bc24824fa32d8 (patch)
tree10027f336435511475e392454359edea8e25895d /image/test/crashtests
parent49ee0794b5d912db1f95dce6eb52d781dc210db5 (diff)
downloadUXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.gz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.lz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.xz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.zip
Add m-esr52 at 52.6.0
Diffstat (limited to 'image/test/crashtests')
-rw-r--r--image/test/crashtests/1205923-1.html36
-rw-r--r--image/test/crashtests/1210745-1.gifbin0 -> 23 bytes
-rw-r--r--image/test/crashtests/1212954-1.svg16
-rw-r--r--image/test/crashtests/1235605.gifbin0 -> 2360 bytes
-rw-r--r--image/test/crashtests/1241728-1.html17
-rw-r--r--image/test/crashtests/1241729-1.bmpbin0 -> 548 bytes
-rw-r--r--image/test/crashtests/1241729-1.html5
-rw-r--r--image/test/crashtests/1242093-1.html22
-rw-r--r--image/test/crashtests/1242778-1.pngbin0 -> 15929 bytes
-rw-r--r--image/test/crashtests/1249576-1.pngbin0 -> 1169 bytes
-rw-r--r--image/test/crashtests/1251091-1.html51
-rw-r--r--image/test/crashtests/1251091-1.pngbin0 -> 95370 bytes
-rw-r--r--image/test/crashtests/1253362-1.html11
-rw-r--r--image/test/crashtests/256-height.icobin0 -> 154 bytes
-rw-r--r--image/test/crashtests/256-width.icobin0 -> 154 bytes
-rw-r--r--image/test/crashtests/463696.bmpbin0 -> 1272 bytes
-rw-r--r--image/test/crashtests/523528-1.gifbin0 -> 132 bytes
-rw-r--r--image/test/crashtests/523528-2.gifbin0 -> 132 bytes
-rw-r--r--image/test/crashtests/570451.pngbin0 -> 114 bytes
-rw-r--r--image/test/crashtests/681190.html10
-rw-r--r--image/test/crashtests/694165-1.xhtml510
-rw-r--r--image/test/crashtests/732319-1.html2
-rw-r--r--image/test/crashtests/83804-1.gifbin0 -> 37 bytes
-rw-r--r--image/test/crashtests/844403-1.html10
-rw-r--r--image/test/crashtests/856616.gifbin0 -> 27 bytes
-rw-r--r--image/test/crashtests/89341-1.gifbin0 -> 769 bytes
-rw-r--r--image/test/crashtests/944353.jpgbin0 -> 610965 bytes
-rw-r--r--image/test/crashtests/colormap-range.gifbin0 -> 5657 bytes
-rw-r--r--image/test/crashtests/crashtests.list51
-rw-r--r--image/test/crashtests/delayedframe.sjs44
-rw-r--r--image/test/crashtests/delaytest.html44
-rw-r--r--image/test/crashtests/discardframe.htm1
-rw-r--r--image/test/crashtests/ie.pngbin0 -> 466589 bytes
-rw-r--r--image/test/crashtests/invalid-disposal-method-1.gifbin0 -> 167 bytes
-rw-r--r--image/test/crashtests/invalid-disposal-method-2.gifbin0 -> 167 bytes
-rw-r--r--image/test/crashtests/invalid-disposal-method-3.gifbin0 -> 167 bytes
-rw-r--r--image/test/crashtests/invalid-icc-profile.jpgbin0 -> 2568 bytes
-rw-r--r--image/test/crashtests/invalid-size-second-frame.gifbin0 -> 673 bytes
-rw-r--r--image/test/crashtests/invalid-size.gifbin0 -> 329 bytes
-rw-r--r--image/test/crashtests/invalid_ico_height.icobin0 -> 894 bytes
-rw-r--r--image/test/crashtests/invalid_ico_width.icobin0 -> 894 bytes
-rw-r--r--image/test/crashtests/multiple-png-hassize.icobin0 -> 18096 bytes
-rw-r--r--image/test/crashtests/ownerdiscard.html49
-rw-r--r--image/test/crashtests/threeframes-end.gifbin0 -> 16 bytes
-rw-r--r--image/test/crashtests/threeframes-start.gifbin0 -> 92 bytes
-rw-r--r--image/test/crashtests/truncated-second-frame.pngbin0 -> 72247 bytes
-rw-r--r--image/test/crashtests/unsized-svg.svg1
47 files changed, 880 insertions, 0 deletions
diff --git a/image/test/crashtests/1205923-1.html b/image/test/crashtests/1205923-1.html
new file mode 100644
index 000000000..456fc51b6
--- /dev/null
+++ b/image/test/crashtests/1205923-1.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<body>
+</body>
+<script>
+ function createImage(loadHandler) {
+ var newImage = new Image;
+ newImage.id = "thepreviewimage";
+ newImage.setAttribute("src", "unsized-svg.svg");
+ if (loadHandler) {
+ newImage.onload = loadHandler;
+ }
+
+ // Query width & height, and display them in document:
+ physWidth = newImage.width;
+ physHeight = newImage.height;
+ document.documentElement.innerHTML +=
+ physWidth + " x " + physHeight + "<br>";
+ }
+
+ function part2() {
+ // Load image again:
+ createImage();
+
+ // End the crashtest.
+ document.documentElement.removeAttribute("class");
+ }
+
+ function startTest() {
+ // Trigger image load, and call part2() when it's loaded:
+ createImage(part2);
+ }
+
+ startTest();
+</script>
+</html>
diff --git a/image/test/crashtests/1210745-1.gif b/image/test/crashtests/1210745-1.gif
new file mode 100644
index 000000000..92bcf7222
--- /dev/null
+++ b/image/test/crashtests/1210745-1.gif
Binary files differ
diff --git a/image/test/crashtests/1212954-1.svg b/image/test/crashtests/1212954-1.svg
new file mode 100644
index 000000000..83dd7b9c7
--- /dev/null
+++ b/image/test/crashtests/1212954-1.svg
@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:xlink="http://www.w3.org/1999/xlink">
+
+ <defs>
+ <filter id="f">
+ <!-- the image data is
+ <svg xmlns="http://www.w3.org/2000/svg" width="-5" height="1%" />
+ -->
+ <feImage xlink:href="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSItNSIgaGVpZ2h0
+PSIxJSIgLz4K" />
+ </filter>
+ </defs>
+
+ <rect width="1" height="1" filter="url(#f)" />
+
+</svg>
diff --git a/image/test/crashtests/1235605.gif b/image/test/crashtests/1235605.gif
new file mode 100644
index 000000000..e7c3ea0b8
--- /dev/null
+++ b/image/test/crashtests/1235605.gif
Binary files differ
diff --git a/image/test/crashtests/1241728-1.html b/image/test/crashtests/1241728-1.html
new file mode 100644
index 000000000..126c02e62
--- /dev/null
+++ b/image/test/crashtests/1241728-1.html
@@ -0,0 +1,17 @@
+<html>
+<body>
+<img id='m1' src='data:image/bmp;base64,Qk16AAAAAAAAAJUAABMoAAAAIA4AACAAACYBAAQAAgAAAAB/AAQCAADE9Sj/AAkAAAAAAAAR4AAAAAD/AAAA//8A////AAAAAAAAAAAAAAAAADAAMzMzMzMzMDMzMwMzGAMzMzMzMzMwABEIAf8AAAAzMzMzMzMwADIzMxERERMzMxERERGAADMzMwAAAIAzMzMzMzMzPzMzMwAAADAAADNGMzMzM0JNegAAAAAAABN2AAAAKAAAACAOAAAgFgAAAQAEAAIAAAAAfxYAEgsAABILAAAAABp/VLge/AAA/+D6AAAAAP8AAP//AP///wAAAAAwAAMzMzMzIgOPMzMzOxCA/42NjY2NjY2NjY0zM0EcMzLgMzAzMzMzMzMzMzMzMzMfAAAREREz/xE2MzczMzwWMzMAAACAMzMzLzMzMz8zMzMAAAAwAAAzRkZGRkYzMzAzMwkDMzMwSjMzMxEzMzMwABERAR4EADPyMzMzMzMwFhYWLQAAAIAzERYGFhYWFhYWVhYWFhYWFhYWFhYWFhYWFhYWFhsWAxYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYzM0EcMzLgMzAzMzMWFhYWFhYW//8AAAMWFhYWFhYWFhEZEREDMzMzMzMzMzMwfzMzM1AzMAMzMzQgAAAAEQMzMzMwFwAIAIMzMzMeYRAcMzLgMzAzMzMzAzL4MzMzMzPoAzMzMzMv+i/uMzMzMzM='>
+<img id='m2' height='2' width='2'>
+<canvas id='c1'></canvas>
+<script>
+ var im1=document.getElementById('m1');
+ var im2=document.getElementById('m2');
+ im2.src=im1.src;
+ window.onload=function(){
+ var ctx=document.getElementById('c1').getContext('2d');
+ ctx.drawImage(im1, 0, 0);
+ ctx.drawImage(im2, 0, 0);
+ }
+</script>
+</body>
+</html> \ No newline at end of file
diff --git a/image/test/crashtests/1241729-1.bmp b/image/test/crashtests/1241729-1.bmp
new file mode 100644
index 000000000..e6f36d039
--- /dev/null
+++ b/image/test/crashtests/1241729-1.bmp
Binary files differ
diff --git a/image/test/crashtests/1241729-1.html b/image/test/crashtests/1241729-1.html
new file mode 100644
index 000000000..47f23134b
--- /dev/null
+++ b/image/test/crashtests/1241729-1.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+<img src="1241729-1.bmp" style="width: 10px; height: 10px;">
+</body>
+</html>
diff --git a/image/test/crashtests/1242093-1.html b/image/test/crashtests/1242093-1.html
new file mode 100644
index 000000000..3eab166ef
--- /dev/null
+++ b/image/test/crashtests/1242093-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset='UTF-8'>
+<meta http-equiv='Cache-control' content='no-cache'>
+</head>
+<body>
+<img id='m1' src='data:image/bmp;base64,Qk1mDgAAAAAAAHYAAAAoAAAAQAEAAPAAAAABAAQAAgAAAPANAADoAwAA6AMAABAAAAAAAAAA/wD/AAAAAAAAAP8AAP8AAP8AAAD///8AzMzMAMzMzADMzMwAzMzMAMzMzADMzMwAzMzMAMzMzADMzMwAzMzMAAACAAEAAgABAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAAAAAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRCAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBpRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAIAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICADgRMCIAAmoAakQAAAACAgA4ETAiAAJqAGpEAAAAAgIABhEBVQURA1UDEQFVCREEVQIRBFUCEQFVCBEBVQYRMCIAAmoAakQAAAACAgAGEQFVBBEBVQMRAVUCEQFVCREBVQURAVUFEQFVCBEBVQYRMCIAAmoAakQAAAACAgAGEQFVBBEBVQMRAVUCEQFVCREBVQURAVUFEQFVCBEBVQYRMCIAAmoAakQAAAACAgAGEQFVBBEBVQMRAVUCEQRVBhEBVQURA1UDEQNVBhEBVQYRMCIAAmoAakQAAAACAgAGEQFVBBEBVQMRAVUCEQFVAxEBVQURAVUFEQFVBREBVQgRAVUGETAiAAJqAGpEAAAAAgIABhEBVQQRAVUDEQFVAhEBVQMRAVUFEQFVBREBVQURAVUIEQFVBhEwIgACagBqRAAAAAICAAMRB1UCEQNVAxEEVQYRAVUFEQRVAhEEVQIRB1UDETAiAAJqAGpEAAAAAgIAOBEwIgACagBqRAAAAAICADgRMCIAAmoAakQAAAACAAEAAgABAAE='>
+<img id='m2' height='2' width='2'>
+<canvas id='c1'></canvas>
+<script>
+ var im1=document.getElementById('m1');
+ var im2=document.getElementById('m2');
+ im2.src=im1.src;
+ window.onload=function(){
+ var ctx=document.getElementById('c1').getContext('2d');
+ ctx.drawImage(im1, 0, 0); // sync docoder call
+ ctx.drawImage(im2, 0, 0); // sync downscaler call
+ }
+</script>
+</body>
+</html> \ No newline at end of file
diff --git a/image/test/crashtests/1242778-1.png b/image/test/crashtests/1242778-1.png
new file mode 100644
index 000000000..4504d54e4
--- /dev/null
+++ b/image/test/crashtests/1242778-1.png
Binary files differ
diff --git a/image/test/crashtests/1249576-1.png b/image/test/crashtests/1249576-1.png
new file mode 100644
index 000000000..637dafbc2
--- /dev/null
+++ b/image/test/crashtests/1249576-1.png
Binary files differ
diff --git a/image/test/crashtests/1251091-1.html b/image/test/crashtests/1251091-1.html
new file mode 100644
index 000000000..520a393b4
--- /dev/null
+++ b/image/test/crashtests/1251091-1.html
@@ -0,0 +1,51 @@
+<!doctype html>
+<html class="reftest-wait">
+ <head>
+ <script type="text/javascript">
+var gl;
+
+function start() {
+ var canvas = document.getElementById("glcanvas");
+ gl = canvas.getContext("webgl") || canvas.getContext("experimental-webgl");
+
+ if (gl) {
+ initTextures();
+ } else {
+ finish();
+ }
+}
+
+function initTextures() {
+ var cubeTexture = gl.createTexture();
+ var cubeImage = document.getElementById("i");
+ cubeImage.onload = function() { handleTextureLoaded(cubeImage, cubeTexture); }
+ cubeImage.onerror = function() { finish(); }
+ cubeImage.src = "1251091-1.png";
+}
+
+function handleTextureLoaded(image, texture) {
+ gl.bindTexture(gl.TEXTURE_2D, texture);
+ gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, gl.RGBA, gl.UNSIGNED_BYTE, image);
+ gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MAG_FILTER, gl.LINEAR);
+ gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MIN_FILTER, gl.LINEAR_MIPMAP_NEAREST);
+ gl.generateMipmap(gl.TEXTURE_2D);
+ gl.bindTexture(gl.TEXTURE_2D, null);
+ setTimeout(showit,0);
+}
+
+function showit() {
+ document.getElementById("i").style.display = "";
+ finish();
+}
+
+function finish() {
+ document.documentElement.removeAttribute("class");
+}
+ </script>
+ </head>
+
+ <body onload="start()">
+ <canvas id="glcanvas" width="640" height="480"></canvas>
+ <img id="i" style="display: none;">
+ </body>
+</html> \ No newline at end of file
diff --git a/image/test/crashtests/1251091-1.png b/image/test/crashtests/1251091-1.png
new file mode 100644
index 000000000..078b19a56
--- /dev/null
+++ b/image/test/crashtests/1251091-1.png
Binary files differ
diff --git a/image/test/crashtests/1253362-1.html b/image/test/crashtests/1253362-1.html
new file mode 100644
index 000000000..fdee850aa
--- /dev/null
+++ b/image/test/crashtests/1253362-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body>
+
+<div style="content: url(data:image/svg+xml;charset=utf-8,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20style%3D%22background%3A%20url%28data%3Aimage%2Fsvg%2Bxml%2C%253Csvg%2520xmlns%253D%2522http%253A%252F%252Fwww.w3.org%252F2000%252Fsvg%2522%253E%253C%252Fsvg%253E%29%22%3E%3C%2Fsvg%3E%0D%0A)"></div>
+
+</body>
+</html>
diff --git a/image/test/crashtests/256-height.ico b/image/test/crashtests/256-height.ico
new file mode 100644
index 000000000..6a3c5c194
--- /dev/null
+++ b/image/test/crashtests/256-height.ico
Binary files differ
diff --git a/image/test/crashtests/256-width.ico b/image/test/crashtests/256-width.ico
new file mode 100644
index 000000000..a82983ce4
--- /dev/null
+++ b/image/test/crashtests/256-width.ico
Binary files differ
diff --git a/image/test/crashtests/463696.bmp b/image/test/crashtests/463696.bmp
new file mode 100644
index 000000000..ec80d5412
--- /dev/null
+++ b/image/test/crashtests/463696.bmp
Binary files differ
diff --git a/image/test/crashtests/523528-1.gif b/image/test/crashtests/523528-1.gif
new file mode 100644
index 000000000..abadca7ad
--- /dev/null
+++ b/image/test/crashtests/523528-1.gif
Binary files differ
diff --git a/image/test/crashtests/523528-2.gif b/image/test/crashtests/523528-2.gif
new file mode 100644
index 000000000..5be3bd46f
--- /dev/null
+++ b/image/test/crashtests/523528-2.gif
Binary files differ
diff --git a/image/test/crashtests/570451.png b/image/test/crashtests/570451.png
new file mode 100644
index 000000000..c49f2d11f
--- /dev/null
+++ b/image/test/crashtests/570451.png
Binary files differ
diff --git a/image/test/crashtests/681190.html b/image/test/crashtests/681190.html
new file mode 100644
index 000000000..b513d5ac6
--- /dev/null
+++ b/image/test/crashtests/681190.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<body>
+<canvas id="crashtest" width="50000" height="50000" />
+<script>
+ document.getElementById("crashtest").mozGetAsFile("foo.png", "image/png");
+ document.getElementById("crashtest").mozGetAsFile("foo.jpeg", "image/jpeg");
+</script>
+</body>
+</html>
diff --git a/image/test/crashtests/694165-1.xhtml b/image/test/crashtests/694165-1.xhtml
new file mode 100644
index 000000000..1e340a0f2
--- /dev/null
+++ b/image/test/crashtests/694165-1.xhtml
@@ -0,0 +1,510 @@
+<!DOCTYPE html [
+ <!ENTITY thousand-g-elements "
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+ &lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;&lt;g/&gt;
+">
+
+]>
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+<img src='data:image/svg+xml,&lt;svg xmlns="http://www.w3.org/2000/svg"&gt;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &thousand-g-elements;
+ &lt;/svg&gt;'/>
+</html>
diff --git a/image/test/crashtests/732319-1.html b/image/test/crashtests/732319-1.html
new file mode 100644
index 000000000..b9d9c6de8
--- /dev/null
+++ b/image/test/crashtests/732319-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<img crossorigin src="data:a/a,">
diff --git a/image/test/crashtests/83804-1.gif b/image/test/crashtests/83804-1.gif
new file mode 100644
index 000000000..3967c703f
--- /dev/null
+++ b/image/test/crashtests/83804-1.gif
Binary files differ
diff --git a/image/test/crashtests/844403-1.html b/image/test/crashtests/844403-1.html
new file mode 100644
index 000000000..5da6c9021
--- /dev/null
+++ b/image/test/crashtests/844403-1.html
@@ -0,0 +1,10 @@
+<color style='background-image: url("data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZlcnNpb249IjEuMSINCiAgICAgd2lkdGg9IjEwMCIgaGVpZ2h0PSIxMDAiPg0KICA8cmVjdCB3aWR0aD0iMTAwJSIgaGVpZ2h0PSIxMDAlIiBmaWxsPSJibHVlIi8%2BDQo8L3N2Zz4NCg%3D%3D");'></color>
+<iframe contenteditable=true></iframe>
+<script>
+ document.body.innerHTML = '';
+ function onload() {
+ e = document.createElementNS("http://www.w3.org/1998/Math/MathML", "share");
+ document.body.appendChild(e);
+ }
+ document.addEventListener("DOMContentLoaded", onload, false);
+</script>
diff --git a/image/test/crashtests/856616.gif b/image/test/crashtests/856616.gif
new file mode 100644
index 000000000..0fac81101
--- /dev/null
+++ b/image/test/crashtests/856616.gif
Binary files differ
diff --git a/image/test/crashtests/89341-1.gif b/image/test/crashtests/89341-1.gif
new file mode 100644
index 000000000..14b3892d1
--- /dev/null
+++ b/image/test/crashtests/89341-1.gif
Binary files differ
diff --git a/image/test/crashtests/944353.jpg b/image/test/crashtests/944353.jpg
new file mode 100644
index 000000000..fd81c5826
--- /dev/null
+++ b/image/test/crashtests/944353.jpg
Binary files differ
diff --git a/image/test/crashtests/colormap-range.gif b/image/test/crashtests/colormap-range.gif
new file mode 100644
index 000000000..887add653
--- /dev/null
+++ b/image/test/crashtests/colormap-range.gif
Binary files differ
diff --git a/image/test/crashtests/crashtests.list b/image/test/crashtests/crashtests.list
new file mode 100644
index 000000000..799c37314
--- /dev/null
+++ b/image/test/crashtests/crashtests.list
@@ -0,0 +1,51 @@
+# Bug 668068 - Maximum (256) width and height icons that we currently interpret as 0-width and 0-height.
+load 256-height.ico
+load 256-width.ico
+
+load 83804-1.gif
+load 89341-1.gif
+load 463696.bmp
+load 570451.png
+skip-if(Android) load 694165-1.xhtml
+load 681190.html
+load 732319-1.html
+load 844403-1.html
+load 856616.gif
+load 944353.jpg
+load 1205923-1.html
+# Ensure we handle detecting that an image is animated, then failing to decode
+# it. (See bug 1210745.)
+load 1210745-1.gif
+load 1212954-1.svg
+load 1235605.gif
+load 1241728-1.html
+load 1241729-1.html
+load 1242093-1.html
+load 1242778-1.png
+load 1249576-1.png
+load 1253362-1.html
+load colormap-range.gif
+HTTP load delayedframe.sjs # A 3-frame animated GIF with an inordinate delay between the second and third frame
+
+# Animated gifs with a very large canvas, but tiny actual content.
+load delaytest.html?523528-1.gif
+load delaytest.html?523528-2.gif
+
+# Bug 1160801 - Ensure that we handle invalid disposal types.
+load invalid-disposal-method-1.gif
+load invalid-disposal-method-2.gif
+load invalid-disposal-method-3.gif
+
+load invalid-icc-profile.jpg # This would have exposed the leak discovered in bug 642902
+
+# Ensure we handle ICO directory entries which specify the wrong size for the contained resource.
+load invalid_ico_height.ico
+load invalid_ico_width.ico
+
+# Bug 525326 - Test image sizes of 65535x65535 which is larger than we allow)
+load invalid-size.gif
+load invalid-size-second-frame.gif
+
+load multiple-png-hassize.ico # Bug 863958 - This icon's size is such that it leads to multiple writes to the PNG decoder after we've gotten our size.
+asserts(0-2) load ownerdiscard.html # Bug 807211
+load truncated-second-frame.png # Bug 863975
diff --git a/image/test/crashtests/delayedframe.sjs b/image/test/crashtests/delayedframe.sjs
new file mode 100644
index 000000000..31eb1eff8
--- /dev/null
+++ b/image/test/crashtests/delayedframe.sjs
@@ -0,0 +1,44 @@
+function getFileStream(filename)
+{
+ // Get the location of this sjs file, and then use that to figure out where
+ // to find where our other files are.
+ var self = Components.classes["@mozilla.org/file/local;1"]
+ .createInstance(Components.interfaces.nsILocalFile);
+ self.initWithPath(getState("__LOCATION__"));
+ var file = self.parent;
+ file.append(filename);
+ dump(file.path + "\n");
+
+ var fileStream = Components.classes['@mozilla.org/network/file-input-stream;1']
+ .createInstance(Components.interfaces.nsIFileInputStream);
+ fileStream.init(file, 1, 0, false);
+
+ return fileStream;
+}
+
+var gTimer;
+
+function handleRequest(request, response)
+{
+ response.processAsync();
+ response.setStatusLine(request.httpVersion, 200, "OK");
+ response.setHeader("Content-Type", "image/gif", false);
+
+ var firststream = getFileStream("threeframes-start.gif");
+ response.bodyOutputStream.writeFrom(firststream, firststream.available())
+ firststream.close();
+
+ gTimer = Components.classes["@mozilla.org/timer;1"].createInstance(Components.interfaces.nsITimer);
+ gTimer.initWithCallback(function()
+ {
+ var secondstream = getFileStream("threeframes-end.gif");
+ response.bodyOutputStream.writeFrom(secondstream, secondstream.available())
+ secondstream.close();
+ response.finish();
+
+ // This time needs to be longer than the animation timer in
+ // threeframes-start.gif. That's specified as 100ms; just use 5 seconds as
+ // a reasonable upper bound. Since this is just a crashtest, timeouts
+ // aren't a big deal.
+ }, 5 * 1000 /* milliseconds */, Components.interfaces.nsITimer.TYPE_ONE_SHOT);
+}
diff --git a/image/test/crashtests/delaytest.html b/image/test/crashtests/delaytest.html
new file mode 100644
index 000000000..00cd1ebd1
--- /dev/null
+++ b/image/test/crashtests/delaytest.html
@@ -0,0 +1,44 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<head>
+<title>Delayed image reftest wrapper</title>
+</head>
+<body>
+<img id="image1">
+<script>
+// This loads a externally specified image, forces a draw (in case of
+// decode-on-draw), waits 350ms, and then triggers the reftest snapshot.
+// This allows the animation on the page to complete.
+//
+// Use as "delaytest.html?animation.png"
+//
+
+// Get the image URL from our URL
+var imgURL = document.location.search.substr(1);
+
+// Load the image
+var img = document.images[0];
+img.src = imgURL;
+img.onload = forceDecode;
+img.onerror = forceDecode;
+
+function forceDecode() {
+
+ try {
+ // We need to force drawing of the image in an invisible context
+ var canvas = document.createElement("canvas");
+ var ctx = canvas.getContext("2d");
+ ctx.drawImage(img, 0, 0);
+ } catch(e) {}
+
+ // We've force the decode. start the timer to trigger the reftest
+ startTimer();
+}
+
+function startTimer() {
+ const delay = 350;
+ setTimeout("document.documentElement.className = '';", delay);
+}
+</script>
+</body>
+</html>
diff --git a/image/test/crashtests/discardframe.htm b/image/test/crashtests/discardframe.htm
new file mode 100644
index 000000000..5ced0029c
--- /dev/null
+++ b/image/test/crashtests/discardframe.htm
@@ -0,0 +1 @@
+<img src=ie.png>
diff --git a/image/test/crashtests/ie.png b/image/test/crashtests/ie.png
new file mode 100644
index 000000000..74c4a1a32
--- /dev/null
+++ b/image/test/crashtests/ie.png
Binary files differ
diff --git a/image/test/crashtests/invalid-disposal-method-1.gif b/image/test/crashtests/invalid-disposal-method-1.gif
new file mode 100644
index 000000000..30c61de18
--- /dev/null
+++ b/image/test/crashtests/invalid-disposal-method-1.gif
Binary files differ
diff --git a/image/test/crashtests/invalid-disposal-method-2.gif b/image/test/crashtests/invalid-disposal-method-2.gif
new file mode 100644
index 000000000..66158d81a
--- /dev/null
+++ b/image/test/crashtests/invalid-disposal-method-2.gif
Binary files differ
diff --git a/image/test/crashtests/invalid-disposal-method-3.gif b/image/test/crashtests/invalid-disposal-method-3.gif
new file mode 100644
index 000000000..0da072377
--- /dev/null
+++ b/image/test/crashtests/invalid-disposal-method-3.gif
Binary files differ
diff --git a/image/test/crashtests/invalid-icc-profile.jpg b/image/test/crashtests/invalid-icc-profile.jpg
new file mode 100644
index 000000000..938c7713c
--- /dev/null
+++ b/image/test/crashtests/invalid-icc-profile.jpg
Binary files differ
diff --git a/image/test/crashtests/invalid-size-second-frame.gif b/image/test/crashtests/invalid-size-second-frame.gif
new file mode 100644
index 000000000..22005ae4c
--- /dev/null
+++ b/image/test/crashtests/invalid-size-second-frame.gif
Binary files differ
diff --git a/image/test/crashtests/invalid-size.gif b/image/test/crashtests/invalid-size.gif
new file mode 100644
index 000000000..665ca9b5d
--- /dev/null
+++ b/image/test/crashtests/invalid-size.gif
Binary files differ
diff --git a/image/test/crashtests/invalid_ico_height.ico b/image/test/crashtests/invalid_ico_height.ico
new file mode 100644
index 000000000..50d684227
--- /dev/null
+++ b/image/test/crashtests/invalid_ico_height.ico
Binary files differ
diff --git a/image/test/crashtests/invalid_ico_width.ico b/image/test/crashtests/invalid_ico_width.ico
new file mode 100644
index 000000000..4ace07c16
--- /dev/null
+++ b/image/test/crashtests/invalid_ico_width.ico
Binary files differ
diff --git a/image/test/crashtests/multiple-png-hassize.ico b/image/test/crashtests/multiple-png-hassize.ico
new file mode 100644
index 000000000..694422001
--- /dev/null
+++ b/image/test/crashtests/multiple-png-hassize.ico
Binary files differ
diff --git a/image/test/crashtests/ownerdiscard.html b/image/test/crashtests/ownerdiscard.html
new file mode 100644
index 000000000..8d4a619fc
--- /dev/null
+++ b/image/test/crashtests/ownerdiscard.html
@@ -0,0 +1,49 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<body>
+ <div id=tCF0>
+ <img id=victim src=ie.png>
+ <iframe src=discardframe.htm></iframe>
+ </div>
+ <script>
+ const Ci = SpecialPowers.Ci;
+ const Cc = SpecialPowers.Cc;
+
+ function ImageDecoderObserverStub()
+ {
+ this.sizeAvailable = function sizeAvailable(aRequest) {}
+ this.frameComplete = function frameComplete(aRequest) {}
+ this.decodeComplete = function decodeComplete(aRequest) {}
+ this.loadComplete = function loadComplete(aRequest) {}
+ this.frameUpdate = function frameUpdate(aRequest) {}
+ this.discard = function discard(aRequest) {}
+ this.isAnimated = function isAnimated(aRequest) {}
+ }
+ var img = document.getElementById('victim');
+ var observer = new ImageDecoderObserverStub();
+ observer.discard = function() {
+ cleanupAndFinish();
+ }
+ observer = SpecialPowers.wrapCallbackObject(observer);
+ var gObserver = Cc["@mozilla.org/image/tools;1"].getService(Ci.imgITools)
+ .createScriptedObserver(observer);
+ var imgLoadingContent =
+ SpecialPowers.wrap(img).QueryInterface(Ci.nsIImageLoadingContent);
+ imgLoadingContent.addObserver(gObserver);
+ function initCF() {
+ setTimeout(function() { document.adoptNode(tCF0); }, 0);
+ }
+ document.addEventListener("DOMContentLoaded", initCF, false);
+
+ function cleanupAndFinish() {
+ imgLoadingContent.removeObserver(gObserver);
+ setTimeout("document.documentElement.className = '';", 0);
+ }
+ function loadhandler() {
+ setTimeout("cleanupAndFinish();", 30000);
+ }
+ window.addEventListener("load", function() {
+ SpecialPowers.pushPrefEnv({"set":[["min_discard_timeout_ms", 1]]}, loadhandler)}, false);
+ </script>
+</body>
+</html>
diff --git a/image/test/crashtests/threeframes-end.gif b/image/test/crashtests/threeframes-end.gif
new file mode 100644
index 000000000..baf6a418c
--- /dev/null
+++ b/image/test/crashtests/threeframes-end.gif
Binary files differ
diff --git a/image/test/crashtests/threeframes-start.gif b/image/test/crashtests/threeframes-start.gif
new file mode 100644
index 000000000..bc641a316
--- /dev/null
+++ b/image/test/crashtests/threeframes-start.gif
Binary files differ
diff --git a/image/test/crashtests/truncated-second-frame.png b/image/test/crashtests/truncated-second-frame.png
new file mode 100644
index 000000000..0aef5e44d
--- /dev/null
+++ b/image/test/crashtests/truncated-second-frame.png
Binary files differ
diff --git a/image/test/crashtests/unsized-svg.svg b/image/test/crashtests/unsized-svg.svg
new file mode 100644
index 000000000..714efc7ef
--- /dev/null
+++ b/image/test/crashtests/unsized-svg.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg"></svg>