diff --git a/layout/xul/base/src/tree/src/crashtests/430394-1.xul b/layout/xul/base/src/tree/src/crashtests/430394-1.xul
new file mode 100644
index 000000000000..63f4c37804b6
--- /dev/null
+++ b/layout/xul/base/src/tree/src/crashtests/430394-1.xul
@@ -0,0 +1,8 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<tree id="a" style="content: 't';" rows="-2">
+  <menuitem id="b" onoverflow="event.currentTarget.parentNode.removeAttribute('style')">
+    <treechildren style="display: block;" onoverflow="event.target.parentNode.removeChild(event.target)" />
+    <treechildren style="display: block;" ordinal="0.5"/>
+  </menuitem>
+</tree>
+</window>
\ No newline at end of file
diff --git a/layout/xul/base/src/tree/src/crashtests/crashtests.list b/layout/xul/base/src/tree/src/crashtests/crashtests.list
index 026380f32af6..326c5c17fc9f 100644
--- a/layout/xul/base/src/tree/src/crashtests/crashtests.list
+++ b/layout/xul/base/src/tree/src/crashtests/crashtests.list
@@ -12,4 +12,5 @@ load 399227-2.xul
 load 399692-1.xhtml
 load 399715-1.xhtml
 load 409807-1.xul
+load 430394-1.xul
 load 454186-1.xul