1 files changed, 33 insertions, 0 deletions
diff --git a/dom/xbl/crashtests/406900-1.xul b/dom/xbl/crashtests/406900-1.xul
new file mode 100644
index 000000000..3b3dc1f87
--- /dev/null
+++ b/dom/xbl/crashtests/406900-1.xul
@@ -0,0 +1,33 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        onload="boom();">
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="lit">
+    <content>
+      <children>
+        <xul:hbox/>
+      </children>
+    </content>
+  </binding>
+</bindings>
+
+<script type="text/javascript"> 
+
+function boom()
+{
+  var x = document.getElementById("x");
+  var anon = document.getAnonymousNodes(x)[0];
+  document.documentElement.removeChild(x);
+  document.documentElement.appendChild(x);
+  var hbox = document.createElement('hbox');
+  anon.appendChild(hbox);
+}
+
+</script>
+
+<hbox id="x" style="-moz-binding: url(#lit)" />
+
+</window>