1 files changed, 24 insertions, 0 deletions
diff --git a/layout/base/crashtests/818454.html b/layout/base/crashtests/818454.html
new file mode 100644
index 0000000000..66e04f8daa
--- /dev/null
+++ b/layout/base/crashtests/818454.html
@@ -0,0 +1,24 @@
+><pre>><style>#parent {
+    position: absolute;
+    }
+#parent::first-letter {
+</style>
+<video></video>>>><div id=parent>
+     <i> 9Z 1CU %b 1	*v
+` mMx#[j
+>></div>
+>><q><dt>><style>
+.class1 { stroke: none; direction: rtl;</style><script>
+var docElement = document.body;
+docElement.contentEditable = "true";
+function crash() {
+test1 = document.createElementNS("http://www.w3.org/1998/Math/MathML", "degree");
+docElement.appendChild(test1);
+test2 = document.createElementNS("http://www.w3.org/1999/xhtml", "textarea");
+docElement.appendChild(test2);
+test3 = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mover");
+test3.setAttribute("class", "class1");
+docElement.appendChild(test3);
+}
+document.addEventListener("DOMContentLoaded", crash);
+</script>>
+\ No newline at end of file