1 files changed, 31 insertions, 0 deletions
diff --git a/layout/xul/crashtests/399013.xul b/layout/xul/crashtests/399013.xul
new file mode 100644
index 0000000000..a2349aff84
--- /dev/null
+++ b/layout/xul/crashtests/399013.xul
@@ -0,0 +1,31 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<menulist id="b" style="display: -moz-groupbox;">
+<panel id="c" style=" position: absolute;">
+<popup onunderflow="document.getElementById('c').removeAttribute('style')"/>
+</panel>
+<menupopup id="a" style="display: -moz-stack;">
+<menulist/>
+</menupopup>
+<panel style="display: -moz-deck;" onoverflow="document.getElementById('b').removeAttribute('style')">
+<popup style="display: -moz-deck;"/>
+</panel>
+</menulist>
+
+<script id="script" xmlns="http://www.w3.org/1999/xhtml"><![CDATA[
+function doe() {
+document.getElementById('c').removeAttribute('style');
+document.documentElement.boxObject.height;
+document.getElementById('b').removeAttribute('style');
+document.getElementById('a').setAttribute('selected', 'true');
+document.getElementById('a').setAttribute('style', 'position: fixed;');
+document.documentElement.boxObject.height;
+document.getElementById('a').removeAttribute('style');
+}
+
+function doe2() {
+window.location.reload();
+}
+setTimeout(doe2, 200);
+setTimeout(doe,100);
+]]></script>
+</window>
+\ No newline at end of file