1 files changed, 28 insertions, 0 deletions
diff --git a/layout/svg/crashtests/354777-1.xhtml b/layout/svg/crashtests/354777-1.xhtml
new file mode 100644
index 000000000..e82baf34c
--- /dev/null
+++ b/layout/svg/crashtests/354777-1.xhtml
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+<script>
+
+var SVG_NS = "http://www.w3.org/2000/svg";
+
+function boom()
+{
+  var svgElem = document.createElementNS(SVG_NS, "svg");
+  var ellipse = document.createElementNS(SVG_NS, "ellipse");
+
+  svgElem.setAttribute("viewBox", "0 0 30 40"); 
+  document.body.appendChild(svgElem);
+  document.body.appendChild(ellipse);
+  ellipse.appendChild(svgElem);
+  svgElem.removeAttribute("viewBox");
+}
+
+</script>
+</head>
+
+<body onload="boom()">
+
+</body>
+
+</html>
+