1 files changed, 25 insertions, 0 deletions
diff --git a/dom/svg/crashtests/413174-1.svg b/dom/svg/crashtests/413174-1.svg
new file mode 100644
index 000000000..1b1bdf0b9
--- /dev/null
+++ b/dom/svg/crashtests/413174-1.svg
@@ -0,0 +1,25 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     onload="boom();">
+
+  <script>
+
+function boom()
+{
+  var g = document.getElementById("g");
+  var use = document.getElementById("use");
+
+  g.appendChild(use);
+  document.documentElement.appendChild(use);
+  document.documentElement.appendChild(g);
+}
+
+  </script>
+
+  <g id="g" style="counter-reset: c;">
+    <rect width="1" height="1"/>
+  </g>
+
+  <use id="use" xlink:href="#g"/>
+
+</svg>