Second testcase from bug 845093

content/base/crashtests/845093-2.html

@@ -0,0 +1,7 @@
+><bdi id=test1><refa id=test2>&#xf921;>></bdi>><h1 id=test3><script>
+document.addEventListener("DOMContentLoaded", CFcrash, false);
+function CFcrash() {
+test1.setAttribute("dir", "invalid");
+test2.textContent = "	&#xf851;S	";
+test3.appendChild(test1);
+}</script>

content/base/crashtests/crashtests.list

@@ -135,6 +135,7 @@ load 841205.html
 load 844404.html
 load 847127.html
 load 845093-1.html
+load 845093-2.html
 load 849601.html
 skip-if(Android) load 851353-1.html
 load 863950.html