diff --git a/content/base/crashtests/847127.html b/content/base/crashtests/847127.html
new file mode 100644
index 000000000000..4d78893d871f
--- /dev/null
+++ b/content/base/crashtests/847127.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var outer = document.createElement("span");
+  outer.dir = "auto";
+  var inner = document.createElement("span");
+  outer.appendChild(inner);
+  inner.appendChild(document.createTextNode("\u202B"));
+  inner.dir = "auto";
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/content/base/crashtests/crashtests.list b/content/base/crashtests/crashtests.list
index c398e7f46e5f..3e7edc7feed0 100644
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@@ -131,3 +131,4 @@ load 829428.html
 load 836890.html
 load 841205.html
 load 844404.html
+load 847127.html
