diff --git a/layout/generic/crashtests/478504.html b/layout/generic/crashtests/478504.html
new file mode 100644
index 000000000000..549c4cf443e4
--- /dev/null
+++ b/layout/generic/crashtests/478504.html
@@ -0,0 +1,33 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script type="text/javascript">
+
+var t;
+
+function a()
+{
+  if (t) document.body.removeChild(t);
+
+  t = document.createTextNode("");
+  document.body.appendChild(t);
+  t.data += "ab\u06CD";
+
+  setTimeout(b, 1);
+}
+
+function b()
+{
+  document.documentElement.offsetHeight;
+  t.data = "d";
+  t.data += " ";
+
+  setTimeout(a, 1);
+}
+
+
+</script>
+</head>
+<body onload="a();">
+</body>
+</html>
diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list
index 5405d4f17bee..147d263eb417 100644
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -345,6 +345,7 @@ load 477928.html
 load 478131-1.html
 load 478170-1.html
 load 478185-1.html
+load 478504.html
 asserts-if(!Android,0-1) load 479938-1.html # Bug 575011
 load 480345-1.html
 load 481921.html
