1 files changed, 29 insertions, 0 deletions
diff --git a/layout/base/crashtests/376223-1.xhtml b/layout/base/crashtests/376223-1.xhtml
new file mode 100644
index 0000000000..91d72b1ffe
--- /dev/null
+++ b/layout/base/crashtests/376223-1.xhtml
@@ -0,0 +1,29 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head>
+<script>
+
+function boom()
+{
+  var listbox = document.getElementById("listbox");
+  var td = document.getElementById("td");
+
+  var listitem = document.createElementNS(XUL_NS, "listitem");
+
+  listbox.appendChild(listitem);
+  listbox.appendChild(td);
+}
+
+var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<table><tbody><tr><td id="td">X</td></tr></tbody></table>
+
+<xul:listbox id="listbox"/>
+
+</body>
+</html>