1 files changed, 32 insertions, 0 deletions
diff --git a/layout/svg/crashtests/402408-1.svg b/layout/svg/crashtests/402408-1.svg
new file mode 100644
index 000000000..f442b2171
--- /dev/null
+++ b/layout/svg/crashtests/402408-1.svg
@@ -0,0 +1,32 @@
+<svg xmlns="http://www.w3.org/2000/svg" 
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     onload="boom();"
+    class="reftest-wait">
+     
+<script>
+
+function boom()
+{
+  var grad1 = document.getElementById("grad1");
+  var grad2 = document.getElementById("grad2");
+
+  grad1.appendChild(grad2);
+
+  setTimeout(function() { 
+    grad1.removeChild(grad2);
+    document.documentElement.removeAttribute("class");
+  }, 30);  
+}
+
+</script>
+
+<linearGradient id="grad1" gradientUnits="objectBoundingBox" x1="0" y1="0" x2="1" y2="0">
+  <stop id="green"   stop-color="#00dd00"   offset="0"/>
+  <stop id="blue"    stop-color="#0000dd"   offset="1"/>
+</linearGradient>
+
+<linearGradient id="grad2" xlink:href="#grad1"/>
+
+<rect x="20" y="20" width="440" height="80" fill="url(#grad2)" />
+
+</svg>