1 files changed, 29 insertions, 0 deletions
diff --git a/layout/base/crashtests/503936-1.html b/layout/base/crashtests/503936-1.html
new file mode 100644
index 0000000000..c1612e8a9d
--- /dev/null
+++ b/layout/base/crashtests/503936-1.html
@@ -0,0 +1,29 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var st = document.getElementById("s").firstChild
+
+  var range = document.createRange();
+  range.setStart(document.documentElement, 0); 
+  range.setEnd(st, 1); 
+  range.deleteContents()
+
+  try { range.surroundContents(st); } catch(e) { }
+}
+
+</script>
+
+<style type="text/css">
+
+div:first-letter { float: left; }
+
+</style>
+</head>
+
+<body onload="boom();"><div><span id="s">Foo</span></div></body>
+
+</html>