1 files changed, 24 insertions, 0 deletions
diff --git a/layout/base/crashtests/466763-1.html b/layout/base/crashtests/466763-1.html
new file mode 100644
index 000000000..406720a32
--- /dev/null
+++ b/layout/base/crashtests/466763-1.html
@@ -0,0 +1,24 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var s = document.getElementById("s");
+  s.appendChild(s.previousSibling);
+  s.parentNode.removeAttribute("class");
+  document.documentElement.offsetHeight;
+  s.appendChild(document.createTextNode(" "));
+}
+
+</script>
+<style type="text/css">
+
+.flfr:first-letter { float: right; }
+
+</style>
+</head>
+
+<body onload="boom();" class="flfr">&#xFEB7; <span id="s"></span></body>
+
+</html>