1 files changed, 25 insertions, 0 deletions
diff --git a/dom/base/crashtests/841205.html b/dom/base/crashtests/841205.html
new file mode 100644
index 0000000000..4de533a885
--- /dev/null
+++ b/dom/base/crashtests/841205.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var b = document.createElement('bdi');
+  var c = document.createElement('div');
+  var d = document.createElement('div');
+
+  b.appendChild(c);
+  c.appendChild(d);
+  b.removeChild(c);
+  d.appendChild(b);
+  document.createElement('div').appendChild(c);
+  b.appendChild(document.createElement('div'));
+
+  b.setAttribute('dir', "auto");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>