1 files changed, 25 insertions, 0 deletions
diff --git a/layout/base/crashtests/429088-2.html b/layout/base/crashtests/429088-2.html
new file mode 100644
index 000000000..dc0caf8e5
--- /dev/null
+++ b/layout/base/crashtests/429088-2.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  window.addEventListener("DOMSubtreeModified", function(){}, false);
+
+  var span = document.createElement("span");
+  document.body.appendChild(span);
+}
+
+</script>
+
+<style type="text/css">
+
+span:before { content: '0'; }
+span:after { content: '1'; }
+
+</style>
+</head>
+
+<body onload="boom();"></body>
+</html>