1 files changed, 39 insertions, 0 deletions
diff --git a/layout/base/crashtests/405186-1.xhtml b/layout/base/crashtests/405186-1.xhtml
new file mode 100644
index 000000000..ec08eab70
--- /dev/null
+++ b/layout/base/crashtests/405186-1.xhtml
@@ -0,0 +1,39 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="foo">
+    <content>
+      <div xmlns="http://www.w3.org/1999/xhtml" style="position: fixed;">
+        <children xmlns="http://www.mozilla.org/xbl"/>
+      </div>
+    </content>
+  </binding>
+</bindings>
+
+<script type="text/javascript">
+
+function boom()
+{
+  var table = document.getElementById("table");
+  var tr = document.getElementById("tr");
+  var td = document.getElementById("td");
+  
+  table.style.border = "2px dotted magenta";
+  tr.removeChild(td);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<table id="table" style="-moz-binding: url(#foo);">
+  <tr id="tr">
+    <td id="td"></td>
+  </tr>
+</table>
+
+</body>
+
+</html>