1 files changed, 26 insertions, 0 deletions
diff --git a/layout/generic/crashtests/654002-2.html b/layout/generic/crashtests/654002-2.html
new file mode 100644
index 000000000..28f820d99
--- /dev/null
+++ b/layout/generic/crashtests/654002-2.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function expStr(s, n)
+{
+  for (var i = 0; i < n; ++i)
+    s += s;
+  return s;
+}
+
+function boom()
+{
+  var s = document.getElementById("s")
+  var t = document.createTextNode(expStr("x ", 15));
+  s.appendChild(t);
+  document.documentElement.offsetHeight;
+  s.removeChild(t);
+}
+  
+</script>
+</head>
+
+<body onload="boom();"><div style="width: 1px"><span id="s"></span></div></body>
+</html>