1 files changed, 31 insertions, 0 deletions
diff --git a/layout/xul/crashtests/432058-1.xul b/layout/xul/crashtests/432058-1.xul
new file mode 100644
index 000000000..a7f63adf8
--- /dev/null
+++ b/layout/xul/crashtests/432058-1.xul
@@ -0,0 +1,31 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
+
+<script type="text/javascript">
+// <![CDATA[
+
+var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+
+function boom()
+{
+  var lb = document.getElementById("lb");
+  var firstli = document.getElementById("firstli");
+  lb.appendChild(document.createElementNS(XUL_NS, "hbox"));
+  lb.appendChild(document.createElementNS(XUL_NS, "listitem"));
+  firstli.style.display = "none";
+
+  // Flush layout.
+  document.getBoxObjectFor(document.documentElement).height;
+
+  lb.removeChild(firstli);
+}
+
+// ]]>
+</script>
+
+<listbox id="lb"><listitem id="firstli"/></listbox>
+
+</window>