Add crashtest for bug 413174

content/svg/content/src/crashtests/413174-1.svg

@@ -0,0 +1,25 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     onload="boom();">
+
+  <script>
+
+function boom()
+{
+  var g = document.getElementById("g");
+  var use = document.getElementById("use");
+
+  g.appendChild(use);
+  document.documentElement.appendChild(use);
+  document.documentElement.appendChild(g);
+}
+
+  </script>
+
+  <g id="g" style="counter-reset: c;">
+    <rect width="1" height="1"/>
+  </g>
+
+  <use id="use" xlink:href="#g"/>
+
+</svg>

content/svg/content/src/crashtests/crashtests.list

@@ -34,6 +34,7 @@ load 410659-1.svg
 load 410659-2.svg
 load 410659-3.svg
 load 412104-1.svg
+load 413174-1.svg
 load 414188-1.svg
 load 428228-1.svg
 load 428841-1.svg