gecko-dev/content/canvas/crashtests/802926-1.html

<!DOCTYPE html>
<script>

document.createElement('canvas').toBlob(null);

</script>