1 files changed, 11 insertions, 0 deletions
diff --git a/dom/base/crashtests/831287.html b/dom/base/crashtests/831287.html
new file mode 100644
index 0000000000..3fc841cc9b
--- /dev/null
+++ b/dom/base/crashtests/831287.html
@@ -0,0 +1,11 @@
+<head dir=auto id=test1><body id=test2><div" id=test3 itemtype=http://example.com/bar style="speak-numeral:> "><canvas id=c><p id=test4>FAIL (fallback content)</p></canvas>
+
+><script>
+document.addEventListener("DOMContentLoaded", CFcrash);
+function CFcrash() {
+test1.appendChild(test4);
+test1.setAttribute("dir", "foopy");
+test1.appendChild(c);
+test4.textContent = test2.outerHTML;
+c.appendChild(test3);
+}</script>>
+\ No newline at end of file