1 files changed, 44 insertions, 0 deletions
diff --git a/layout/base/crashtests/840480.html b/layout/base/crashtests/840480.html
new file mode 100644
index 0000000000..7ef5944d58
--- /dev/null
+++ b/layout/base/crashtests/840480.html
@@ -0,0 +1,44 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+<HTML>
+<BODY>
+<CENTER ID="Test-CENTER">
+</CENTER>
+<BR />
+<B ID="Test-B" ></B>
+<BR />
+<DL>
+  <DT ID="Test-DT" CLASS="DT-class"></DT>
+</DL>
+<SPAN ID="Test-SPAN" CLASS="SPAN-class"></SPAN>
+<DFN ID="Test-DFN" >
+        <VAR ID="Test-VAR"></VAR>
+        <CITE ID="Test-CITE">Boom</CITE>
+</DFN>
+<ABBR ID="Test-ABBR" ></ABBR>
+<script type="text/javascript"> 
+
+ document.head.appendChild(document.createElement("style"));
+var styleSheet0 = document.styleSheets[0];
+
+var test0=document.getElementById("Test-DT")
+var test4=document.getElementById("Test-DFN")
+var test5=document.getElementById("Test-CENTER")
+var test7=document.getElementById("Test-B")
+var test18=document.getElementById("Test-ABBR")
+var test19=document.getElementById("Test-SPAN")
+
+for(x=0;x<14;x++){
+  test18.appendChild(test5.cloneNode(true));
+test18.appendChild(test7);
+test19.appendChild(test4.cloneNode(true));
+}
+
+styleSheet0.insertRule('.U-class,.DT-class,.SPAN-class,.I-class{display: table-caption; content: counter(c, binary); counter-increment:c;}',0);
+window.scrollTo(688,835)
+styleSheet0.insertRule('#Test-SPAN,#Test-NOFRAMES,#Test-CITE,#Test-EM{list-style-type:upper-roman; transition-property:none; transform:rotate(-90deg) translate(-2em, -18em); background-clip:border-box; border-collapse:collapsed; }',0);
+test7.style.setProperty('overflow','hidden','important');
+test7.appendChild(test0.cloneNode(true));
+</script>
+
+</BODY>
+</HTML>