1 files changed, 26 insertions, 0 deletions
diff --git a/dom/smil/crashtests/588287-2.svg b/dom/smil/crashtests/588287-2.svg
new file mode 100644
index 0000000000..70d8e76391
--- /dev/null
+++ b/dom/smil/crashtests/588287-2.svg
@@ -0,0 +1,26 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait">
+<script>
+
+function boom()
+{
+  var animate = document.createElementNS("http://www.w3.org/2000/svg", "animate");
+  animate.setAttributeNS(null, "begin", "0.5s");
+  document.documentElement.appendChild(animate);
+  
+  setTimeout(function() {
+    var g = document.createElement("g");
+    var svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+    g.appendChild(svg);
+    document.documentElement.appendChild(g);
+    svg.setCurrentTime(0.2);
+    svg.appendChild(animate);
+    svg.setCurrentTime(0.0); // Trigger backwards seek
+    document.documentElement.removeAttribute("class");
+  }, 400);
+}
+
+window.addEventListener("load", function() { setTimeout(boom, 200) }, false);
+
+</script>
+</svg>