1 files changed, 38 insertions, 0 deletions
diff --git a/dom/base/crashtests/401993-1.html b/dom/base/crashtests/401993-1.html
new file mode 100644
index 000000000..b8679dfd0
--- /dev/null
+++ b/dom/base/crashtests/401993-1.html
@@ -0,0 +1,38 @@
+<html class="reftest-wait">
+<head>
+<script>
+
+function s()
+{
+  var x = document.getElementById("x");
+  x.style.MozBinding = "url(401993-1.xml#foo)";
+  
+  setTimeout(boom, 0);
+  
+  function boom()
+  {
+    var nodes = SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(x));
+    if (!nodes) {
+      setTimeout(boom, 10);
+      return;
+    }
+
+    var newSpan = document.createElement("span");
+    newSpan.contentEditable = "true";
+    nodes[0].appendChild(newSpan);
+    x.parentNode.removeChild(x);
+    
+    document.documentElement.removeAttribute("class");
+  }
+}
+</script>
+</head>
+
+<body onload="s();">
+
+<span contenteditable="true"></span>
+
+<div id="x"></div>
+
+</body>
+</html>