3 files changed, 92 insertions, 0 deletions
diff --git a/layout/generic/crashtests/1381134-2.html b/layout/generic/crashtests/1381134-2.html
new file mode 100644
index 000000000..d3ac73507
--- /dev/null
+++ b/layout/generic/crashtests/1381134-2.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+addEventListener("DOMContentLoaded", () => {
+  [d1, d2] = document.getElementsByTagName("div");
+  [s1, s2] = document.getElementsByTagName("span")
+  d3 = document.createElement("div")
+  d4 = document.createElement("div")
+  d4.setAttribute("class", "grid")
+  d3.appendChild(d4)
+  d1.appendChild(document.createElement("span"))
+  setTimeout(() => {
+    d2.removeChild(s2)
+    setTimeout(() => {
+      d2.insertBefore(d3, s1)
+    }, 100)
+  }, 100)
+})
+</script>
+<style>
+.columns {
+  columns: 3;
+}
+.grid {
+  border:5px solid;
+  counter-reset: item;
+}
+.grid * { display:block; }
+span { display:contents; }
+span::before { content: counter(item) ":before"; }
+span::after { content: counter(item) ":after"; }
+</style>
+</head>
+<body>
+<div class=columns>
+<div class=grid>
+<c></c>
+<span><c></c></span>
+<span><c></c></span>
+</div>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1381134.html b/layout/generic/crashtests/1381134.html
new file mode 100644
index 000000000..a45fa04ec
--- /dev/null
+++ b/layout/generic/crashtests/1381134.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+addEventListener("DOMContentLoaded", () => {
+  [d1, d2] = document.getElementsByTagName("div");
+  [s1, s2] = document.getElementsByTagName("span")
+  d3 = document.createElement("div")
+  d4 = document.createElement("div")
+  d4.setAttribute("class", "grid")
+  d3.appendChild(d4)
+  d1.appendChild(document.createElement("span"))
+  setTimeout(() => {
+    d2.removeChild(s2)
+    setTimeout(() => {
+      d2.insertBefore(d3, s1)
+    }, 100)
+  }, 100)
+})
+</script>
+<style>
+.columns {
+  columns: 3;
+}
+.grid {
+  display: grid;
+  border:5px solid;
+  counter-reset: item;
+}
+span { display:contents; }
+span::before { content: counter(item) ":before"; }
+span::after { content: counter(item) ":after"; }
+</style>
+</head>
+<body>
+<div class=columns>
+<div class=grid>
+<c></c>
+<span><c></c></span>
+<span><c></c></span>
+</div>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list
index a3c0d62c6..1a597e51c 100644
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -642,3 +642,5 @@ load 1278461-1.html
 load 1278461-2.html
 load 1304441.html
 load 1316649.html
+load 1381134.html
+load 1381134-2.html