gecko-dev/dom/html/crashtests/916322-2.html

<canvas height=200 id=gl>
<script>
// Without the fix, this would trigger an assertion in the debug build
document.addEventListener("DOMContentLoaded", DifferentSizes);
function DifferentSizes() {
  gl.getContext("2d");
  gl.removeAttribute('height');
  gl.toBlob(function() { }, false)
}
</script>