1 files changed, 68 insertions, 0 deletions
diff --git a/dom/base/crashtests/1840191.html b/dom/base/crashtests/1840191.html
new file mode 100644
index 0000000000..5c3c7f6c32
--- /dev/null
+++ b/dom/base/crashtests/1840191.html
@@ -0,0 +1,68 @@
+<head>
+<script>
+function go() {
+    document.onreadystatechange = () => { a.submit() }
+    window.stop()
+}
+</script>
+</head>
+<!-- a -->
+<body>
+<wbr>
+<map>
+<output>
+<fieldset>
+<keygen>
+</fieldset>
+<iframe></iframe>
+<h1>
+<form>
+</bgsound>
+</option>
+</form>
+<data>
+<form id="a" target="b">
+<output>
+<output>
+<picture>
+<pre></pre>
+</data>
+<output>
+<textarea onfocus="go()" autofocus="">
+</textarea>
+<dl>
+<dt>
+<input>
+</dt>
+<dt>
+<dd>
+<table>
+<marquee>
+<frameset>
+<frame>
+</frame>
+</frameset>
+<bdo>
+<canvas>
+<video>
+<input>
+<time>
+<keygen>
+<audio>
+<track>
+<source>
+<select>
+<optgroup>
+<option>
+<option>
+</select>
+<bdi>
+<h4>
+<img>
+<sub>
+<picture>
+<h4>
+<link>
+<link>
+<!-- a -->
+</html>