1 files changed, 23 insertions, 0 deletions
diff --git a/layout/generic/crashtests/603510-1.html b/layout/generic/crashtests/603510-1.html
new file mode 100644
index 0000000000..90d16bed2d
--- /dev/null
+++ b/layout/generic/crashtests/603510-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<script>
+
+function boom()
+{
+  var r = document.documentElement;
+
+  while (r.firstChild)
+    r.firstChild.remove();
+
+  var a = document.createTextNode("a");
+  r.appendChild(a);
+  a.splitText(0);
+  a.splitText(0);
+
+  document.documentElement.offsetHeight;
+
+  r.appendChild(document.createTextNode("b"));
+}
+
+window.addEventListener("load", boom);
+
+</script>