1 files changed, 23 insertions, 0 deletions
diff --git a/layout/base/crashtests/1576972-1.html b/layout/base/crashtests/1576972-1.html
new file mode 100644
index 0000000000..8f20f3b727
--- /dev/null
+++ b/layout/base/crashtests/1576972-1.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+    <style>
+        * {
+            quotes: none !important;
+        }
+    </style>
+    <script>
+      function start () {
+        const o1 = document.getElementById('id_1')
+        const o2 = document.createElement('q')
+        const o3 = document.createElement('v')
+        document.documentElement.appendChild(o1)
+        o3.dir = 'rtl'
+        o2.appendChild(o3)
+        document.documentElement.appendChild(o2)
+      }
+
+      document.addEventListener('DOMContentLoaded', start)
+    </script>
+</head>
+<q id="id_1">
+</html>