1 files changed, 21 insertions, 0 deletions
diff --git a/layout/base/crashtests/522374-2.html b/layout/base/crashtests/522374-2.html
new file mode 100644
index 000000000..934a6649d
--- /dev/null
+++ b/layout/base/crashtests/522374-2.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html><html class="reftest-wait"><head><script type="text/javascript">
+
+function boom()
+{
+  var area = document.getElementById("area");
+  var main = document.getElementById("main");
+
+  area.nextSibling.data += " a ";
+  document.documentElement.offsetHeight;
+  area.nextSibling.data = " b ";
+  main.previousSibling.data += " \u042A ";
+  
+  document.documentElement.removeAttribute("class");
+}
+
+function boom0(ev)
+{
+  setTimeout(boom, 0);
+}
+
+</script></head><body onload="boom0();"> <div id="main" style="width: 1px;"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVR42mP4z8AAAAMBAQD3A0FDAAAAAElFTkSuQmCC" usemap="#Map"><map name="Map"><area id="area">        </map></div></body></html>
+\ No newline at end of file