1 files changed, 22 insertions, 0 deletions
diff --git a/dom/xslt/crashtests/528300.xml b/dom/xslt/crashtests/528300.xml
new file mode 100644
index 000000000..8902bb373
--- /dev/null
+++ b/dom/xslt/crashtests/528300.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xml" href="#bug"?>
+<!DOCTYPE doc [
+<!ATTLIST xsl:transform
+  id	ID	#REQUIRED>
+]>
+<doc>
+<xsl:transform
+  xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+  version="2.0"
+  id="bug">
+  <xsl:variable name="v0">
+    <xsl:for-each select="$v0" />
+  </xsl:variable>
+  <xsl:template name="t2" match="/">
+    <xsl:copy-of select="number($v0)" />
+  </xsl:template>
+</xsl:transform>
+
+<e1 />
+
+</doc>