1 files changed, 21 insertions, 0 deletions
diff --git a/dom/base/crashtests/607222.html b/dom/base/crashtests/607222.html
new file mode 100644
index 0000000000..a9491b3429
--- /dev/null
+++ b/dom/base/crashtests/607222.html
@@ -0,0 +1,21 @@
+<html><body>
+<script>
+
+  function G(str){
+    var cobj=document.createElement(str);
+    document.body.appendChild(cobj);
+    cobj.scrollWidth;
+  }
+
+  function crashme() {
+    document.write("fooFOO");
+    G("a");
+    document.write("<a lang></a>a");
+    G("base");
+    document.write("barBAR");
+    G("audio");
+  }
+</script>
+<script>crashme();</script>
+</body>
+</html>