1 files changed, 26 insertions, 0 deletions
diff --git a/layout/generic/crashtests/1638860-2.html b/layout/generic/crashtests/1638860-2.html
new file mode 100644
index 0000000000..a04861a662
--- /dev/null
+++ b/layout/generic/crashtests/1638860-2.html
@@ -0,0 +1,26 @@
+<html>
+<body>
+    <style>
+        div {
+            position: relative;
+        }
+        span,div {
+            display: inline-grid;
+            grid-template-columns: subgrid;
+        }
+        span {
+            position: absolute;
+        }
+    </style>
+    <script>
+      window.addEventListener('load', () => {
+        const span = document.createElementNS('http://www.w3.org/1999/xhtml', 'span')
+        const text = document.createTextNode('BAR')
+        span.appendChild(text)
+        const div = document.getElementsByTagName('div')[0];
+        div.appendChild(span)
+      })
+    </script>
+<div>FOO</div>
+</body>
+</html>