1 files changed, 33 insertions, 0 deletions
diff --git a/layout/generic/crashtests/478504.html b/layout/generic/crashtests/478504.html
new file mode 100644
index 0000000000..549c4cf443
--- /dev/null
+++ b/layout/generic/crashtests/478504.html
@@ -0,0 +1,33 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script type="text/javascript">
+
+var t;
+
+function a()
+{
+  if (t) document.body.removeChild(t);
+
+  t = document.createTextNode("");
+  document.body.appendChild(t);
+  t.data += "ab\u06CD";
+
+  setTimeout(b, 1);
+}
+
+function b()
+{
+  document.documentElement.offsetHeight;
+  t.data = "d";
+  t.data += " ";
+
+  setTimeout(a, 1);
+}
+
+
+</script>
+</head>
+<body onload="a();">
+</body>
+</html>