diff --git a/layout/base/crashtests/1428892.html b/layout/base/crashtests/1428892.html
new file mode 100644
index 000000000000..e8d3b4c61d0d
--- /dev/null
+++ b/layout/base/crashtests/1428892.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<script>
+img = new Image(0, 2)
+document.documentElement.appendChild(img)
+frm = document.createElement("iframe")
+frm.align = "right"
+document.documentElement.appendChild(frm)
+img.append(undefined, undefined, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\rAAAAA=[AAAAAAAAAAAAAA\u066B\bAAAAAAAAAAAAAAAA*<AAAAAA")
+</script>
+<style>
+html { width: 300px; -moz-column-width: 100px; height: 100px; }
+</style>
+<div style="float: left; height: 5px;"></div>
+<div style="clear: left;"><feDiffuseLighting><div style="float: right;"></div></div>
diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list
index 403c1f77680b..92126db6b166 100644
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -516,6 +516,7 @@ load 1423216.html
 load 1425893.html
 load 1425959.html
 load 1428353.html
+load 1428892.html
 load 1429088.html
 load 1429961.html
 load 1429962.html
