1 files changed, 26 insertions, 0 deletions
diff --git a/dom/smil/crashtests/592477-1.xhtml b/dom/smil/crashtests/592477-1.xhtml
new file mode 100644
index 000000000..c44a470a3
--- /dev/null
+++ b/dom/smil/crashtests/592477-1.xhtml
@@ -0,0 +1,26 @@
+<xht:table xmlns:xht="http://www.w3.org/1999/xhtml"
+           xmlns:xbl="http://www.mozilla.org/xbl">
+  <xht:script type="text/javascript">// <![CDATA[
+   function boom() {
+     var topRight = document.getElementById('topRight');
+     topRight.appendChild(document.createElement("g"));
+   }
+//]]> </xht:script>
+
+<xbl:bindings>
+  <xbl:binding>
+    <svg xmlns="http://www.w3.org/2000/svg"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         onload="setTimeout(boom, 0)">
+      <defs>
+        <g id="markerGroup">
+          <g id="topLeft"/>
+          <g id="topRight"/>
+          <set xlink:href="#topLeft" attributeName="fill" to="green" dur="1s"/>
+        </g>
+      </defs>
+      <use xlink:href="#markerGroup"/>
+    </svg>
+  </xbl:binding>
+</xbl:bindings>
+</xht:table>