From 5f8de423f190bbb79a62f804151bc24824fa32d8 Mon Sep 17 00:00:00 2001
From: "Matt A. Tobin" <mattatobin@localhost.localdomain>
Date: Fri, 2 Feb 2018 04:16:08 -0500
Subject: Add m-esr52 at 52.6.0

---
 dom/canvas/crashtests/0px-size-font-667225.html |  19 +++++
 dom/canvas/crashtests/0px-size-font-shadow.html |  17 ++++
 dom/canvas/crashtests/1099143-1.html            |   5 ++
 dom/canvas/crashtests/1161277-1.html            |  22 +++++
 dom/canvas/crashtests/1183363.html              |  23 ++++++
 dom/canvas/crashtests/1190705.html              |  17 ++++
 dom/canvas/crashtests/1223740-1.html            |  22 +++++
 dom/canvas/crashtests/1225381-1.html            |  17 ++++
 dom/canvas/crashtests/1229932-1.html            |  16 ++++
 dom/canvas/crashtests/1229983-1.html            |  24 ++++++
 dom/canvas/crashtests/1233613.html              |  19 +++++
 dom/canvas/crashtests/1244850-1.html            |  22 +++++
 dom/canvas/crashtests/1246775-1.html            |  15 ++++
 dom/canvas/crashtests/1283113-1.html            |  25 ++++++
 dom/canvas/crashtests/1284356-1.html            |   9 ++
 dom/canvas/crashtests/1284578-1.html            |   8 ++
 dom/canvas/crashtests/1286458-1.html            |  20 +++++
 dom/canvas/crashtests/1287515-1.html            |   7 ++
 dom/canvas/crashtests/1287652-1.html            |   8 ++
 dom/canvas/crashtests/1288872-1.html            |   6 ++
 dom/canvas/crashtests/1290628-1.html            |  13 +++
 dom/canvas/crashtests/1298576-1.html            |  21 +++++
 dom/canvas/crashtests/1299062-1.html            |   5 ++
 dom/canvas/crashtests/1305312-1.html            |   5 ++
 dom/canvas/crashtests/1334647-1.html            |   8 ++
 dom/canvas/crashtests/1357092.html              |  10 +++
 dom/canvas/crashtests/360293-1.html             |  35 ++++++++
 dom/canvas/crashtests/421715-1.html             |  41 ++++++++++
 dom/canvas/crashtests/553938-1.html             |  20 +++++
 dom/canvas/crashtests/647480.html               | 104 ++++++++++++++++++++++++
 dom/canvas/crashtests/727547.html               |   7 ++
 dom/canvas/crashtests/729116.html               |  18 ++++
 dom/canvas/crashtests/743499-negative-size.html |  22 +++++
 dom/canvas/crashtests/745699-1.html             |  25 ++++++
 dom/canvas/crashtests/745818-large-source.html  |  21 +++++
 dom/canvas/crashtests/746813-1.html             |   6 ++
 dom/canvas/crashtests/767337-1.html             |  21 +++++
 dom/canvas/crashtests/779426.html               |  19 +++++
 dom/canvas/crashtests/780392-1.html             |  10 +++
 dom/canvas/crashtests/789933-1.html             |  13 +++
 dom/canvas/crashtests/794463-1.html             |  17 ++++
 dom/canvas/crashtests/802926-1.html             |   6 ++
 dom/canvas/crashtests/896047-1.html             |  17 ++++
 dom/canvas/crashtests/896047-2.html             |  19 +++++
 dom/canvas/crashtests/916128-1.html             |  13 +++
 dom/canvas/crashtests/934939-1.html             |   8 ++
 dom/canvas/crashtests/crashtests.list           |  44 ++++++++++
 dom/canvas/crashtests/texImage2D.html           |   8 ++
 48 files changed, 877 insertions(+)
 create mode 100644 dom/canvas/crashtests/0px-size-font-667225.html
 create mode 100644 dom/canvas/crashtests/0px-size-font-shadow.html
 create mode 100644 dom/canvas/crashtests/1099143-1.html
 create mode 100644 dom/canvas/crashtests/1161277-1.html
 create mode 100644 dom/canvas/crashtests/1183363.html
 create mode 100644 dom/canvas/crashtests/1190705.html
 create mode 100644 dom/canvas/crashtests/1223740-1.html
 create mode 100644 dom/canvas/crashtests/1225381-1.html
 create mode 100644 dom/canvas/crashtests/1229932-1.html
 create mode 100644 dom/canvas/crashtests/1229983-1.html
 create mode 100644 dom/canvas/crashtests/1233613.html
 create mode 100644 dom/canvas/crashtests/1244850-1.html
 create mode 100644 dom/canvas/crashtests/1246775-1.html
 create mode 100644 dom/canvas/crashtests/1283113-1.html
 create mode 100644 dom/canvas/crashtests/1284356-1.html
 create mode 100644 dom/canvas/crashtests/1284578-1.html
 create mode 100644 dom/canvas/crashtests/1286458-1.html
 create mode 100644 dom/canvas/crashtests/1287515-1.html
 create mode 100644 dom/canvas/crashtests/1287652-1.html
 create mode 100644 dom/canvas/crashtests/1288872-1.html
 create mode 100644 dom/canvas/crashtests/1290628-1.html
 create mode 100644 dom/canvas/crashtests/1298576-1.html
 create mode 100644 dom/canvas/crashtests/1299062-1.html
 create mode 100644 dom/canvas/crashtests/1305312-1.html
 create mode 100644 dom/canvas/crashtests/1334647-1.html
 create mode 100644 dom/canvas/crashtests/1357092.html
 create mode 100644 dom/canvas/crashtests/360293-1.html
 create mode 100644 dom/canvas/crashtests/421715-1.html
 create mode 100644 dom/canvas/crashtests/553938-1.html
 create mode 100644 dom/canvas/crashtests/647480.html
 create mode 100644 dom/canvas/crashtests/727547.html
 create mode 100644 dom/canvas/crashtests/729116.html
 create mode 100644 dom/canvas/crashtests/743499-negative-size.html
 create mode 100644 dom/canvas/crashtests/745699-1.html
 create mode 100644 dom/canvas/crashtests/745818-large-source.html
 create mode 100644 dom/canvas/crashtests/746813-1.html
 create mode 100644 dom/canvas/crashtests/767337-1.html
 create mode 100644 dom/canvas/crashtests/779426.html
 create mode 100644 dom/canvas/crashtests/780392-1.html
 create mode 100644 dom/canvas/crashtests/789933-1.html
 create mode 100644 dom/canvas/crashtests/794463-1.html
 create mode 100644 dom/canvas/crashtests/802926-1.html
 create mode 100644 dom/canvas/crashtests/896047-1.html
 create mode 100644 dom/canvas/crashtests/896047-2.html
 create mode 100644 dom/canvas/crashtests/916128-1.html
 create mode 100644 dom/canvas/crashtests/934939-1.html
 create mode 100644 dom/canvas/crashtests/crashtests.list
 create mode 100644 dom/canvas/crashtests/texImage2D.html

(limited to 'dom/canvas/crashtests')

diff --git a/dom/canvas/crashtests/0px-size-font-667225.html b/dom/canvas/crashtests/0px-size-font-667225.html
new file mode 100644
index 000000000..9de65f8f5
--- /dev/null
+++ b/dom/canvas/crashtests/0px-size-font-667225.html
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml" >
+<script language=javascript>
+
+function draw() {
+  var canv = document.getElementById("canv");
+  var ctx = canv.getContext("2d");
+
+  ctx.fillStyle = "red";
+  // 0 size font shouldn't crash!
+  ctx.font = "0px Arial";
+  ctx.fillText("A", 0, 0);
+  document.documentElement.className = "";
+}
+
+</script>
+<body onload="draw()">
+<canvas id="canv" width="5" height="5"></canvas>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/0px-size-font-shadow.html b/dom/canvas/crashtests/0px-size-font-shadow.html
new file mode 100644
index 000000000..1298f3fa1
--- /dev/null
+++ b/dom/canvas/crashtests/0px-size-font-shadow.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<body>
+<canvas id="canv" width="5" height="5"></canvas>
+<script>
+var canv = document.getElementById("canv");
+var ctx = canv.getContext("2d");
+
+ctx.fillStyle = "red";
+// 0 size font shouldn't assert!
+ctx.font = "0px Arial";
+ctx.shadowColor = '#f00';
+ctx.shadowBlur = 4;
+ctx.fillText("A", 0, 0);
+document.documentElement.className = "";
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/1099143-1.html b/dom/canvas/crashtests/1099143-1.html
new file mode 100644
index 000000000..30bb3a003
--- /dev/null
+++ b/dom/canvas/crashtests/1099143-1.html
@@ -0,0 +1,5 @@
+<script>
+  var canvas = document.createElement("canvas");
+  var context = canvas.getContext("2d");
+  context.fillText("", 0, 0);
+</script>
diff --git a/dom/canvas/crashtests/1161277-1.html b/dom/canvas/crashtests/1161277-1.html
new file mode 100644
index 000000000..3e04dc46d
--- /dev/null
+++ b/dom/canvas/crashtests/1161277-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+    var canvas = document.createElement('canvas');
+    var ctx = canvas.getContext('2d');
+    ctx.setTransform(0.2988847856952777, 26589683732.25, -562949953421312, 5, 4503599627370495, -2735897607.139075);
+    ctx.bezierCurveTo(-1023, -4611686018427388000, 4194303, -536870911, 45139.65058316886, 35184372088833);
+    ctx.setLineDash([1.2307692307692308]);
+    ctx.setTransform(0, 2097152, 0.0005128205128205128, 305943.4982061649, -49282.263290019946, 3);
+    ctx.clip("evenodd");
+    ctx.scale(-2.3882113703861325, -2);
+    ctx.isPointInStroke(2, 86124313031369.77);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/1183363.html b/dom/canvas/crashtests/1183363.html
new file mode 100644
index 000000000..2044a8092
--- /dev/null
+++ b/dom/canvas/crashtests/1183363.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+    var ctx = canvas.getContext('2d');
+    ctx.rect(2, 6, 9, 8);
+    ctx.setTransform(1, 2, 3, 0, 4, 1);
+    setTimeout(function() {
+        ctx.moveTo(0, 1);
+        ctx.isPointInPath(0, 0, 'evenodd');
+    }, 0);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<canvas id="canvas"></canvas>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/1190705.html b/dom/canvas/crashtests/1190705.html
new file mode 100644
index 000000000..64795decb
--- /dev/null
+++ b/dom/canvas/crashtests/1190705.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+    var canvas = document.createElement('canvas');
+    var ctx = canvas.getContext('2d');
+    ctx.rotate(1e308);
+    ctx.fillText("A", 1, 1);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/1223740-1.html b/dom/canvas/crashtests/1223740-1.html
new file mode 100644
index 000000000..d5d969693
--- /dev/null
+++ b/dom/canvas/crashtests/1223740-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom() {
+    var canvas = document.createElement('canvas');
+    var ctx = canvas.getContext('2d');
+    ctx.shadowColor = "green";
+    ctx.rotate(0.9923);
+    ctx.transform(6, 0.13807760834183488, 256, -0.39007851257689263, 0.5767177072299453, 64);
+    ctx.transform(0.61, 0.08697788582345888, 6, 6, 64, 128);
+    ctx.scale(0.36690500480283633, 6);
+    ctx.shadowOffsetY = -1.7976931348623157e+308;
+    ctx.fillText("A",32,0.848476537933684);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/1225381-1.html b/dom/canvas/crashtests/1225381-1.html
new file mode 100644
index 000000000..4519508a3
--- /dev/null
+++ b/dom/canvas/crashtests/1225381-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom() {
+    var canvas = document.createElement('canvas');
+    var ctx = canvas.getContext('2d');
+    ctx.mozCurrentTransformInverse = [32, -1, 0.8320478957221024, 1.7976931348623157e+308, 512, 0.9012573524148337];
+    ctx.fillText("A", 0 ,0);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/1229932-1.html b/dom/canvas/crashtests/1229932-1.html
new file mode 100644
index 000000000..b5f06ff85
--- /dev/null
+++ b/dom/canvas/crashtests/1229932-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom() {
+    var canvas = document.createElement('canvas');
+    var ctx = canvas.getContext('2d');
+    ctx.fillText("A", 0, 1e308);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/1229983-1.html b/dom/canvas/crashtests/1229983-1.html
new file mode 100644
index 000000000..a865c569e
--- /dev/null
+++ b/dom/canvas/crashtests/1229983-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom() {
+    var canvas = document.createElement('canvas');
+    var ctx = canvas.getContext('2d');
+    ctx.lineJoin = 'round';
+    ctx.transform(18.5, 41.6, 447, 78.2, 85.75, 120.5);
+    ctx.transform(186.25, 26.142857142857142, 251.5, -562949953421311, 147, 4.625);
+    ctx.rotate(32);
+    ctx.arc(33.8, 1, 183, 141.5, 452.5, 0);
+    ctx.transform(423, 24.75, 78, 12, 180.25, 191.5);
+    ctx.shadowBlur = 31.5;
+    ctx.shadowColor = "blue";
+    ctx.stroke();
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/1233613.html b/dom/canvas/crashtests/1233613.html
new file mode 100644
index 000000000..d949c3b21
--- /dev/null
+++ b/dom/canvas/crashtests/1233613.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<iframe style="display:none" srcdoc="
+
+<html>
+<head>
+<script type='text/javascript'>
+function boom() {
+    var gl = canvas.getContext('experimental-webgl');
+    video.srcObject = canvas.captureStream(0);
+}
+</script>
+</head>
+<body onload='boom();'>
+    <video id='video' width='256' height='256'></video>
+    <canvas id='canvas' width='256' height='256'></canvas>
+</body>
+</html>
+
+"></iframe>
diff --git a/dom/canvas/crashtests/1244850-1.html b/dom/canvas/crashtests/1244850-1.html
new file mode 100644
index 000000000..015baf2c0
--- /dev/null
+++ b/dom/canvas/crashtests/1244850-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+    var canvas = document.createElement('canvas');
+    var ctx = canvas.getContext('2d');
+    var svgImage = document.getElementsByTagName("img")[0];
+    ctx.drawImage(svgImage, 1e+308, 0);
+}
+
+</script>
+</head>
+<body onload="boom();">
+
+<img src="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' width='100' height='100'><rect width='100' height='100' fill='blue'/></svg>">
+
+</body>
+</html>
diff --git a/dom/canvas/crashtests/1246775-1.html b/dom/canvas/crashtests/1246775-1.html
new file mode 100644
index 000000000..8c4ddabdf
--- /dev/null
+++ b/dom/canvas/crashtests/1246775-1.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+<script>
+function boom()
+{
+  var canvas = document.getElementById("canvas");
+  var ctx = SpecialPowers.wrap(canvas.getContext("2d"));
+  ctx.drawWindow(window, 0, 0, canvas.width, canvas.height, "red");
+}
+</script>
+</head>
+<body onload="boom();">
+<canvas id="canvas" width="10" height="10"></canvas>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/1283113-1.html b/dom/canvas/crashtests/1283113-1.html
new file mode 100644
index 000000000..50234169b
--- /dev/null
+++ b/dom/canvas/crashtests/1283113-1.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+    var canvas = document.createElement('canvas');
+    var ctx = canvas.getContext('2d');
+    ctx.transform(1,1,0,0,0,0);
+    ctx.scale(610.561277214,0.0);
+    ctx.scale(442.538892637,64.9064087241);
+    ctx.scale(851.176724189,322.349092655);
+    ctx.scale(862.937434575,2.88757032711);
+    ctx.scale(230.933492526,766.024348731);
+    ctx.scale(968.538114712,4.580);
+    ctx.transform(1,0,1,0,1,0);
+    ctx.scale(341.640607159,753.362567174);
+    ctx.measureText('');
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/1284356-1.html b/dom/canvas/crashtests/1284356-1.html
new file mode 100644
index 000000000..bbdb135b0
--- /dev/null
+++ b/dom/canvas/crashtests/1284356-1.html
@@ -0,0 +1,9 @@
+<canvas id='i0'></canvas>
+<script>
+var c=document.getElementById('i0').getContext('2d');
+c.lineWidth=194.622602174;
+c.miterLimit=270.273509738;
+c.transform(0,0,0,0,0,0);
+c.globalCompositeOperation='soft-light';
+c.strokeText('a',200,273,722);
+</script>
\ No newline at end of file
diff --git a/dom/canvas/crashtests/1284578-1.html b/dom/canvas/crashtests/1284578-1.html
new file mode 100644
index 000000000..ba6e5f963
--- /dev/null
+++ b/dom/canvas/crashtests/1284578-1.html
@@ -0,0 +1,8 @@
+<canvas id='i0'></canvas>
+<script>
+var c=document.getElementById('i0').getContext('2d');
+c.bezierCurveTo(157,351,351,44,946,701);
+c.quadraticCurveTo(260,-9007199254740991,945,145);
+c.translate(-9007199254740991,239);
+c.isPointInPath(988,439);
+</script>
\ No newline at end of file
diff --git a/dom/canvas/crashtests/1286458-1.html b/dom/canvas/crashtests/1286458-1.html
new file mode 100644
index 000000000..1241a5f0e
--- /dev/null
+++ b/dom/canvas/crashtests/1286458-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+    var canvas = document.createElement('canvas');
+    var ctx = canvas.getContext('2d');
+    var path=new Path2D();
+    path.bezierCurveTo(436,Number.MIN_VALUE,620,Number.MAX_SAFE_INTEGER,1,83);
+    ctx.setTransform(1,Number.MAX_SAFE_INTEGER,1,0,1,146.0);
+    ctx.scale(16777218,55);
+    ctx.stroke(path);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/1287515-1.html b/dom/canvas/crashtests/1287515-1.html
new file mode 100644
index 000000000..37dc8a2a0
--- /dev/null
+++ b/dom/canvas/crashtests/1287515-1.html
@@ -0,0 +1,7 @@
+<canvas id='i0'></canvas>
+<script>
+var c=document.getElementById('i0').getContext('2d');
+c.lineWidth=Number.MAX_SAFE_INTEGER;
+c.setLineDash([1]);
+c.strokeRect(1,1,0,Number.MIN_SAFE_INTEGER);
+</script>
diff --git a/dom/canvas/crashtests/1287652-1.html b/dom/canvas/crashtests/1287652-1.html
new file mode 100644
index 000000000..7eaccd58a
--- /dev/null
+++ b/dom/canvas/crashtests/1287652-1.html
@@ -0,0 +1,8 @@
+<canvas id='i0'></canvas>
+<script>
+var c=document.getElementById('i0').getContext('2d');
+var g=c.createLinearGradient(59,9,38.89,-75.51);
+c.fillStyle=g;
+c.globalAlpha=0.62;
+c.fillText('a',0,24,30);
+</script>
diff --git a/dom/canvas/crashtests/1288872-1.html b/dom/canvas/crashtests/1288872-1.html
new file mode 100644
index 000000000..de57311a5
--- /dev/null
+++ b/dom/canvas/crashtests/1288872-1.html
@@ -0,0 +1,6 @@
+<canvas id='id0'></canvas>
+<script>
+var c=document.getElementById('id0').getContext('2d');
+c.transform(1,0,1,0,0,0);
+c.fillText('A',0,53);
+</script>
\ No newline at end of file
diff --git a/dom/canvas/crashtests/1290628-1.html b/dom/canvas/crashtests/1290628-1.html
new file mode 100644
index 000000000..a2502f70a
--- /dev/null
+++ b/dom/canvas/crashtests/1290628-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<body id='test_body'>
+<canvas id='i0'></canvas>
+<script>
+var c=document.getElementById('i0').getContext('2d');
+c.shadowOffsetX=73;
+c.scale(5,55);
+c.setLineDash([48,81,88,41,32767,8]);
+c.shadowColor='hsl(1.0,1%,1%)';
+c.miterLimit=Number.MIN_VALUE;
+c.strokeRect(0,58,8589934591,0);
+</script>
\ No newline at end of file
diff --git a/dom/canvas/crashtests/1298576-1.html b/dom/canvas/crashtests/1298576-1.html
new file mode 100644
index 000000000..b3936027e
--- /dev/null
+++ b/dom/canvas/crashtests/1298576-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script id="fshader" type="x-shader/x-fragment">
+void main() {
+  -2147483648 % 0xffffffff;
+  gl_FragColor = vec4(0.5, 0.5, 1.0, 1.0);
+}
+</script>
+</head>
+<body>
+<script>
+var gl = document.createElement('canvas').getContext('webgl');
+var program = gl.createProgram();
+var fshader = gl.createShader(gl.FRAGMENT_SHADER);
+var fshaderSource = document.getElementById("fshader").text;
+gl.shaderSource(fshader, fshaderSource);
+gl.compileShader(fshader);
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/1299062-1.html b/dom/canvas/crashtests/1299062-1.html
new file mode 100644
index 000000000..2f33b889a
--- /dev/null
+++ b/dom/canvas/crashtests/1299062-1.html
@@ -0,0 +1,5 @@
+<canvas id='id0' width='35376.4661501'></canvas>
+<script>
+var ctx=document.getElementById('id0').getContext('2d');
+ctx.getImageData(66,-1,32,87);
+</script>
diff --git a/dom/canvas/crashtests/1305312-1.html b/dom/canvas/crashtests/1305312-1.html
new file mode 100644
index 000000000..3bd0b8c00
--- /dev/null
+++ b/dom/canvas/crashtests/1305312-1.html
@@ -0,0 +1,5 @@
+<canvas id='cid'></canvas>
+<script>
+var x=document.getElementById('cid').getContext('2d',{alpha: false});
+x.putImageData(x.createImageData(250,27434.63),Number.MAX_SAFE_INTEGER,23);
+</script>
\ No newline at end of file
diff --git a/dom/canvas/crashtests/1334647-1.html b/dom/canvas/crashtests/1334647-1.html
new file mode 100644
index 000000000..b4510afeb
--- /dev/null
+++ b/dom/canvas/crashtests/1334647-1.html
@@ -0,0 +1,8 @@
+<script>
+Logger={}; Logger.JSError=function(e){};
+try { o0 = document.createElement('canvas'); } catch(e) { Logger.JSError(e); }
+try { (document.body || document.documentElement).appendChild(o0) } catch(e) { Logger.JSError(e); }
+try { o1 = o0.getContext('2d'); } catch(e) { Logger.JSError(e); }
+try { o0.width = 311853383.455201; } catch(e) { Logger.JSError(e); }
+try { o1.drawImage(o0, -0.906275445340731, 0.3679144809413502, 2, 32) } catch(e) { Logger.JSError(e); }
+</script>
diff --git a/dom/canvas/crashtests/1357092.html b/dom/canvas/crashtests/1357092.html
new file mode 100644
index 000000000..110aa7e86
--- /dev/null
+++ b/dom/canvas/crashtests/1357092.html
@@ -0,0 +1,10 @@
+<html>
+    <head>
+        <script>
+            o1 = document.createElement("canvas");
+            o1.setAttribute("width", "100000");
+            o2 = o1.getContext("2d");
+            o2.bezierCurveTo(64, 1, 1, 1, 1, 1);
+        </script>
+    </head>
+</html>
diff --git a/dom/canvas/crashtests/360293-1.html b/dom/canvas/crashtests/360293-1.html
new file mode 100644
index 000000000..8a0859e41
--- /dev/null
+++ b/dom/canvas/crashtests/360293-1.html
@@ -0,0 +1,35 @@
+<html>
+
+
+<body>
+ Firefox: <a href="javascript:noCrash()">no crash</a> | <a href="javascript:crash()">crash</a><br/>
+ <canvas id="foo" width="200" height="200">
+ </canvas>
+ <script>
+   function d(lineWidth){
+    var c = document.getElementById("foo").getContext("2d")
+    c.clearRect(0,0,200,200)
+    c.lineWidth = lineWidth
+    c.beginPath()
+    c.arc(100,100,80, Math.PI, 2*Math.PI, 1)
+    c.stroke()
+    c.beginPath()
+    c.arc(50,50, 20, 0, 2*Math.PI, 1)
+    c.stroke()
+    c.beginPath()
+    c.arc(150,50, 20, 0, 2*Math.PI, 1)
+    c.stroke()
+   }
+   function noCrash() {
+     d(Math.random()*20+5)
+   }
+   function crash() {
+     d( '_' )
+   }
+
+   crash();
+ </script>
+
+</body>
+
+</html>
diff --git a/dom/canvas/crashtests/421715-1.html b/dom/canvas/crashtests/421715-1.html
new file mode 100644
index 000000000..c2ea9b28a
--- /dev/null
+++ b/dom/canvas/crashtests/421715-1.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <script type="text/javascript">
+      function stringify(a) {
+        if (a)
+          return a.toSource();
+        return ''+a;
+      }
+      var args = [undefined, null, [], {}, 0, "0"];
+      var stringArgs = args.map(stringify);
+
+      function test_method(context, method, arity) {
+        function testParams(existingParams, depth) {
+          for (var arg of stringArgs) {
+            var code = "context[method](" + existingParams + arg + ")";
+            try {
+              eval(code);
+            } catch (ex) {
+              // Exceptions are expected
+            }
+
+            if (depth < arity)
+              testParams(existingParams + arg + ",", depth + 1);
+          }
+        }
+        testParams("", 1);
+      }
+
+      function startTest() {
+        var canvas = document.getElementById("img");
+        var context = canvas.getContext('2d');;
+        test_method(context, "getImageData", 4);
+        test_method(context, "putImageData", 3);
+      }
+    </script>
+  </head>
+  <body onload="startTest()">
+    <canvas id="img">No canvas support.</canvas>
+  </body>
+</html>
diff --git a/dom/canvas/crashtests/553938-1.html b/dom/canvas/crashtests/553938-1.html
new file mode 100644
index 000000000..97e6b6c8a
--- /dev/null
+++ b/dom/canvas/crashtests/553938-1.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<html>
+  <head>
+    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
+    <title>ImageData Crash Test</title>
+  </head>
+  <body onload="crash();">
+    <canvas id="c" width="10" height="10"></canvas>
+    <script>
+      function crash() {
+        var canvas = document.getElementById('c');
+        var ctx = canvas.getContext('2d');
+        var imgData = {data: new Array(10*10*4), width: 10, height: 10};
+
+        imgData[0] = 0;
+        ctx.putImageData(imgData, 0, 0);
+      }
+    </script>
+  </body>
+</html>
diff --git a/dom/canvas/crashtests/647480.html b/dom/canvas/crashtests/647480.html
new file mode 100644
index 000000000..15b6b6a1b
--- /dev/null
+++ b/dom/canvas/crashtests/647480.html
@@ -0,0 +1,104 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var canvas = document.createElementNS("http://www.w3.org/1999/xhtml", "canvas");
+  var ctx = canvas.getContext("2d");
+  document.implementation.createDocument("", "", null).adoptNode(canvas);
+
+  try { ctx.save(); } catch(e){}
+  try { ctx.restore(); } catch(e){}
+  try { ctx.scale(0,0); } catch(e){}
+  try { ctx.rotate(90); } catch(e){}
+  try { ctx.translate(1,1); } catch(e){}
+  try { ctx.transform(0,100,200,300,10,10); } catch(e){}
+  try { ctx.setTransform(0,100,200,300,10,10); } catch(e){}
+
+  try { x = ctx.globalAlpha; } catch(e){}
+  try { ctx.globalAlpha = 0.8; } catch(e){}
+  try { x = ctx.globalCompositeOperation; } catch(e){}
+  try { ctx.globalCompositeOperation = "copy"; } catch(e){}
+  try { x = ctx.strokeStyle; } catch(e){}
+  try { ctx.strokeStyle = "red"; } catch(e){}
+  try { x = ctx.fillStyle; } catch(e){}
+  try { ctx.fillStyle = "red"; } catch(e){}
+
+  try { ctx.createLinearGradient(0,100,100,100); } catch(e){}
+  try { ctx.createRadialGradient(0,100,100,100,10,10); } catch(e){}
+  try { ctx.createPattern(document.getElementsByTagName('img')[0], "repeat"); } catch(e){}
+
+  try { x = ctx.lineWidth; } catch(e){}
+  try { ctx.lineWidth = 2; } catch(e){}
+  try { x = ctx.lineCap; } catch(e){}
+  try { ctx.lineCap = "round"; } catch(e){}
+  try { x = ctx.lineJoin; } catch(e){}
+  try { ctx.lineJoin = "bevel"; } catch(e){}
+  try { x = ctx.miterLimit; } catch(e){}
+  try { ctx.miterLimit = 12; } catch(e){}
+
+  try { x = ctx.shadowOffsetX; } catch(e){}
+  try { ctx.shadowOffsetX = 1; } catch(e){}
+  try { x = ctx.shadowOffsetY; } catch(e){}
+  try { ctx.shadowOffsetY = 1; } catch(e){}
+  try { x = ctx.shadowBlur; } catch(e){}
+  try { ctx.shadowBlur = 1; } catch(e){}
+  try { x = ctx.shadowColor; } catch(e){}
+  try { ctx.shadowColor = "red"; } catch(e){}
+
+  try { ctx.clearRect(0,0,100,100); } catch(e){}
+  try { ctx.fillRect(0,0,100,100); } catch(e){}
+  try { ctx.strokeRect(0,0,100,100); } catch(e){}
+
+  try { ctx.beginPath(); } catch(e){}
+  try { ctx.moveTo(1,1); } catch(e){}
+  try { ctx.lineTo(10,10); } catch(e){}
+  try { ctx.quadraticCurveTo(1,2,3,4); } catch(e){}
+  try { ctx.bezierCurveTo(1,2,3,4,5,6); } catch(e){}
+  try { ctx.arcTo(1,2,3,4,5); } catch(e){}
+  try { ctx.arc(1,2,3,4,5); } catch(e){}
+  try { ctx.arc(1,2,3,4,5,true); } catch(e){}
+  try { ctx.rect(1,2,3,4); } catch(e){}
+  try { ctx.closePath(); } catch(e){}
+
+  try { ctx.fill(); } catch(e){}
+  try { ctx.stroke(); } catch(e){}
+  try { ctx.clip(); } catch(e){}
+
+  try { x = ctx.font; } catch(e){}
+  try { ctx.font = "14px sans-serif"; } catch(e){}
+  try { x = ctx.mozTextStyle; } catch(e){}
+  try { ctx.mozTextStyle = "14px sans-serif"; } catch(e){}
+  try { x = ctx.textAlign; } catch(e){}
+  try { ctx.textAlign = "right"; } catch(e){}
+  try { x = ctx.textBaseline; } catch(e){}
+  try { ctx.textBaseline = "top"; } catch(e){}
+
+  try { ctx.fillText("",0,0); } catch(e){}
+  try { ctx.strokeText("",0,0); } catch(e){}
+  try { ctx.measureText(""); } catch(e){}
+
+  try { ctx.mozDrawText(""); } catch(e){}
+  try { ctx.mozPathText(""); } catch(e){}
+  try { ctx.mozTextAlongPath("",true); } catch(e){}
+  try { ctx.mozTextAlongPath("",false); } catch(e){}
+
+  try { ctx.drawImage(document.getElementsByTagName('img')[0], 0, 0); } catch(e){}
+  try { ctx.isPointInPath(0, 0); } catch(e){}
+  try { ctx.createImageData(); } catch(e){}
+  try { ctx.getImageData(); } catch(e){}
+  try { ctx.putImageData(); } catch(e){}
+
+  try { x = ctx.imageSmoothingEnabled;  } catch(e){}
+  try { ctx.imageSmoothingEnabled = false;  } catch(e){}
+  try { ctx.imageSmoothingEnabled = true;  } catch(e){}
+
+  try { ctx.drawWindow(window, 0, 0, 0, 0, "red"); } catch(e){}
+}
+
+</script>
+</head>
+<body onload="boom();"><img width="100" height="100" src="data:image/gif;base64,R0lGODlhAQABAIABAAD/AP///ywAAAAAAQABAAACAkQBADs="></body>
+</html>
diff --git a/dom/canvas/crashtests/727547.html b/dom/canvas/crashtests/727547.html
new file mode 100644
index 000000000..005841de8
--- /dev/null
+++ b/dom/canvas/crashtests/727547.html
@@ -0,0 +1,7 @@
+<!doctype html>
+<canvas></canvas>
+<script>
+var canvas = document.body.firstChild,
+    gl = canvas.getContext("experimental-webgl");
+gl.texImage2D(0, 0, 0, 0, 0, { width: 10, height: 10, data: 7 });
+</script>
diff --git a/dom/canvas/crashtests/729116.html b/dom/canvas/crashtests/729116.html
new file mode 100644
index 000000000..679f9d296
--- /dev/null
+++ b/dom/canvas/crashtests/729116.html
@@ -0,0 +1,18 @@
+<html>
+<script language=javascript>
+
+function draw() {
+  var canv = document.getElementById("canv");
+  var ctx = canv.getContext("2d");
+  try {
+    canv.width = 50000;
+  } catch (e) { }
+
+  ctx.clearRect(0, 0, 10, 10);
+}
+
+</script>
+<body onload="draw()">
+<canvas id="canv" width="5" height="5"></canvas>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/743499-negative-size.html b/dom/canvas/crashtests/743499-negative-size.html
new file mode 100644
index 000000000..7cfcd55b2
--- /dev/null
+++ b/dom/canvas/crashtests/743499-negative-size.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+    <title></title>
+    <script type="text/javascript">
+        function go() {
+        var canvas = document.createElement("canvas");
+        var ctx = canvas.getContext('2d');
+        ctx.globalAlpha = 4
+        ctx.lineCap = "foo"
+        ctx.strokeRect(256,1024,8,4)
+        ctx.shadowColor = "black"
+        ctx.shadowOffsetY = 64
+        ctx.stroke()
+        ctx.moveTo(32,1024)
+        ctx.closePath()
+        }
+    </script>
+</head>
+<body onload="go()">
+<canvas id="canvas"></canvas>
+</body>
+</html>
\ No newline at end of file
diff --git a/dom/canvas/crashtests/745699-1.html b/dom/canvas/crashtests/745699-1.html
new file mode 100644
index 000000000..c65acf201
--- /dev/null
+++ b/dom/canvas/crashtests/745699-1.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+@font-face {
+  font-family: "z";
+  src: url(invalid);
+}
+</style>
+
+<script>
+function boom()
+{
+  var ctx = document.querySelector("canvas").getContext('2d');
+  ctx.font = "10px serif";
+  document.querySelector("style").appendChild(document.createTextNode(" "));
+  ctx.measureText("123");
+}
+</script>
+</head>
+
+<body onload="boom();">
+<canvas width="100" height="100"></canvas>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/745818-large-source.html b/dom/canvas/crashtests/745818-large-source.html
new file mode 100644
index 000000000..a5be76be0
--- /dev/null
+++ b/dom/canvas/crashtests/745818-large-source.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var a = document.getElementById("a");
+  var b = document.getElementById("b");
+  a.getContext('2d').createPattern(b, 'no-repeat');
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<canvas id="a" width="61" height="26"></canvas>
+<canvas id="b" width="611" height="439807"></canvas>
+</body>
+
+</html>
diff --git a/dom/canvas/crashtests/746813-1.html b/dom/canvas/crashtests/746813-1.html
new file mode 100644
index 000000000..18e52b4c9
--- /dev/null
+++ b/dom/canvas/crashtests/746813-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.getElementById('c').getContext('2d').mozCurrentTransformInverse;">
+<canvas id="c" width="772" height="76441"></canvas>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/767337-1.html b/dom/canvas/crashtests/767337-1.html
new file mode 100644
index 000000000..3c2c4ebd1
--- /dev/null
+++ b/dom/canvas/crashtests/767337-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<body>
+<canvas id="c" width="500" height="1000">
+</canvas>
+<script>
+var ctxt = document.getElementById('c').getContext('2d');
+for (var k = 0; k < 100; ++j) {
+  for (var j = 0; j < 10; ++j) {
+    for (var i = 0; i < 1000; ++i) {
+      gradient = ctxt.createLinearGradient(0,0,200,i);
+      gradient.addColorStop(0,'black');
+      gradient.addColorStop(1,'rgba(0, 255*k/100, 0, 0.1)');
+      ctxt.fillStyle = gradient;
+      ctxt.fillRect(j*50, 2*i, 50, 2);
+    }
+  }
+}
+</script>
+</body>
+</html>
\ No newline at end of file
diff --git a/dom/canvas/crashtests/779426.html b/dom/canvas/crashtests/779426.html
new file mode 100644
index 000000000..ded3455b8
--- /dev/null
+++ b/dom/canvas/crashtests/779426.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var canvas = document.createElementNS('http://www.w3.org/1999/xhtml', 'canvas');
+  var canvas2d = canvas.getContext('2d');
+  canvas2d.rect(0, 0, 1, 1);
+  canvas2d.transform(1, 0, 0, 1, 0, 0);
+  canvas.setAttributeNS(null, "height", "99");
+  canvas2d.rect(0, 0, 1, 1);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/canvas/crashtests/780392-1.html b/dom/canvas/crashtests/780392-1.html
new file mode 100644
index 000000000..2112c9a75
--- /dev/null
+++ b/dom/canvas/crashtests/780392-1.html
@@ -0,0 +1,10 @@
+<!doctype HTML>
+<html>
+<body>
+<canvas id="c" width="10000" height="10000"></canvas>
+<script>
+var ctx = document.getElementById("c").getContext("2d");
+ctx.fillText("Hello world!", 50, 50);
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/789933-1.html b/dom/canvas/crashtests/789933-1.html
new file mode 100644
index 000000000..a5f2f3437
--- /dev/null
+++ b/dom/canvas/crashtests/789933-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<body>
+<canvas id="c" width="5000" height="20000">
+</canvas>
+<script>
+var ctxt = document.getElementById('c').getContext('2d');
+ctxt.strokeStyle = "Red";
+ctxt.font = "bold 16px Arial";
+ctxt.strokeText('Hello World!', 100, 100);
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/794463-1.html b/dom/canvas/crashtests/794463-1.html
new file mode 100644
index 000000000..5726baa74
--- /dev/null
+++ b/dom/canvas/crashtests/794463-1.html
@@ -0,0 +1,17 @@
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+
+<!doctype HTML>
+<html>
+<body>
+<canvas id="c" width="100" height="100"></canvas>
+<script>
+var c = document.getElementById("c");
+var ctx = c.getContext("2d");
+var p = ctx.createPattern(c, "no-repeat");
+ctx.rect(0, 0, 100, 100);
+ctx.fillStyle = p;
+ctx.fill();
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/802926-1.html b/dom/canvas/crashtests/802926-1.html
new file mode 100644
index 000000000..a42ca50c1
--- /dev/null
+++ b/dom/canvas/crashtests/802926-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<script>
+
+document.createElement('canvas').toBlob(null);
+
+</script>
diff --git a/dom/canvas/crashtests/896047-1.html b/dom/canvas/crashtests/896047-1.html
new file mode 100644
index 000000000..2b121b227
--- /dev/null
+++ b/dom/canvas/crashtests/896047-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<body>
+<canvas id="c" width="200" height="100">
+</canvas>
+<script>
+var ctx = document.getElementById("c").getContext("2d");
+ctx.save();
+ctx.save();
+ctx.rect(0,0, 1,1);
+ctx.restore();
+ctx.fill('evenodd');
+ctx.restore();
+ctx.lineTo(10, 0);
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/896047-2.html b/dom/canvas/crashtests/896047-2.html
new file mode 100644
index 000000000..4cd12dfb4
--- /dev/null
+++ b/dom/canvas/crashtests/896047-2.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<body>
+<canvas id="c" width="200" height="100">
+</canvas>
+<script>
+var ctx = document.getElementById("c").getContext("2d");
+ctx.save();
+ctx.mozFillRule = 'nonzero';
+ctx.save();
+ctx.mozFillRule = 'evenodd';
+ctx.rect(0,0, 1,1);
+ctx.restore();
+ctx.isPointInPath(0,0);
+ctx.restore();
+ctx.lineTo(10, 0);
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/916128-1.html b/dom/canvas/crashtests/916128-1.html
new file mode 100644
index 000000000..cddd5185e
--- /dev/null
+++ b/dom/canvas/crashtests/916128-1.html
@@ -0,0 +1,13 @@
+<script>
+o0 = document.createElement('canvas');
+(document.body || document.documentElement).appendChild(o0);
+o1 = o0.getContext('2d');
+o2 = document.createElement('img');
+//o2.src = "image2.png";
+o3 = o1.createImageData(0.7409945472006207, 0.8815588599260801);
+o1.save();
+o1.mozCurrentTransform = [0.18777365986904448, 4, 4, -2048, 3, 32];
+o0.width = 0.52;
+o1.putImageData(o3, -32, -0.16596290333335356);
+o0.toBlob(function() {}, "video/mp4", 16);
+</script>
diff --git a/dom/canvas/crashtests/934939-1.html b/dom/canvas/crashtests/934939-1.html
new file mode 100644
index 000000000..d2ffbf475
--- /dev/null
+++ b/dom/canvas/crashtests/934939-1.html
@@ -0,0 +1,8 @@
+<script type="text/javascript">
+  function run() {
+    var cx = canvas.getContext("2d");
+    canvas.toDataURL("image/png");
+  }
+</script>
+<body onload="run()">
+<canvas width="1" height="65536" id="canvas"></canvas>
diff --git a/dom/canvas/crashtests/crashtests.list b/dom/canvas/crashtests/crashtests.list
new file mode 100644
index 000000000..9da7dafa1
--- /dev/null
+++ b/dom/canvas/crashtests/crashtests.list
@@ -0,0 +1,44 @@
+load 0px-size-font-667225.html
+load 0px-size-font-shadow.html
+load 360293-1.html
+load 421715-1.html
+load 553938-1.html
+load 647480.html
+load 727547.html
+load 729116.html
+load 745699-1.html
+load 746813-1.html
+load 743499-negative-size.html
+skip-if(Android) load 745818-large-source.html # Bug XXX - Crashes Android mid-run w/o a stack
+load 767337-1.html
+load 779426.html
+skip-if(Android) load 780392-1.html
+skip-if(Android) skip-if(gtkWidget&&isDebugBuild) load 789933-1.html # bug 1155252 for linux
+load 794463-1.html
+load 802926-1.html
+load 896047-1.html
+load 916128-1.html
+load 934939-1.html
+load 1099143-1.html
+load 1161277-1.html
+load 1183363.html
+load 1190705.html
+load 1223740-1.html
+load 1225381-1.html
+skip-if(azureCairo) load 1229983-1.html
+load 1229932-1.html
+load 1244850-1.html
+load 1246775-1.html
+load 1284356-1.html
+load 1284578-1.html
+skip-if(d2d) load 1287515-1.html
+load 1287652-1.html
+load 1288872-1.html
+load 1290628-1.html
+load 1283113-1.html
+load 1286458-1.html
+load 1299062-1.html
+load 1305312-1.html
+load 1298576-1.html
+load 1334647-1.html
+load 1357092.html
diff --git a/dom/canvas/crashtests/texImage2D.html b/dom/canvas/crashtests/texImage2D.html
new file mode 100644
index 000000000..370b00857
--- /dev/null
+++ b/dom/canvas/crashtests/texImage2D.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<canvas></canvas>
+<script>
+var canvas = document.body.firstChild,
+    gl = canvas.getContext("experimental-webgl");
+gl.texImage2D(0, 0, 0, 0, 0, { get width() { throw 7 }, get height() { throw 7 }, data: new Uint8ClampedArray(10) });
+gl.texSubImage2D(0, 0, 0, 0, 0, 0, { get width() { throw 7 }, get height() { throw 7 }, data: new Uint8ClampedArray(10) });
+</script>
-- 
cgit v1.2.3