Bug 395609 - Crash test.

layout/xul/base/src/crashtests/395609.xul

@@ -0,0 +1,16 @@
+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<box style=" display: -moz-inline-stack; position: absolute; " id="a"/>
+
+<box style="display: table-row;" observes="a">
+<box onoverflow="event.currentTarget.parentNode.removeAttribute('style')">
+<box style="position: absolute;"/>
+<box style=" display: table-cell;">
+  <box style="overflow: auto; float: right; " onoverflow="event.target.parentNode.removeChild(event.target)" />
+</box>
+</box>
+<box style="position: fixed; ">
+  <editor src="http://google.com/"/>
+</box>
+</box>
+</window>

layout/xul/base/src/crashtests/crashtests.list

@@ -47,6 +47,7 @@ load 387033-1.xhtml
 load 387080-1.xul
 load 391974-1.html
 load 394120-1.xhtml
+load 395609.xul
 load 397304-1.html
 load 398326-1.xhtml
 load 400779-1.xhtml