1 files changed, 21 insertions, 0 deletions
diff --git a/dom/html/crashtests/682460.html b/dom/html/crashtests/682460.html
new file mode 100644
index 000000000..91306be71
--- /dev/null
+++ b/dom/html/crashtests/682460.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var f = function() {
+    document.documentElement.offsetHeight;
+  };
+  window.addEventListener("DOMSubtreeModified", f, true);
+
+  document.getElementsByTagName("table")[0].setAttribute("cellpadding", "2");
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<table><tr><td></td></tr></table>
+</body>
+</html>