1 files changed, 28 insertions, 0 deletions
diff --git a/layout/generic/crashtests/417109-1.xhtml b/layout/generic/crashtests/417109-1.xhtml
new file mode 100644
index 000000000..f1b93c4c6
--- /dev/null
+++ b/layout/generic/crashtests/417109-1.xhtml
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="foo">
+    <content><html:span> &#x200F;&#x0643;&#xCA84;<children/></html:span></content>
+  </binding>
+  <binding id="empty">
+    <content></content>
+  </binding>
+</bindings>
+
+
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+  document.getElementById("b").style.MozBinding = "url('#empty')";
+}
+
+]]>
+</script>
+</head>
+
+<body onload="boom();"><table style="-moz-binding: url(#foo)"><td id="b"/></table></body>
+
+</html>