diff --git a/layout/style/crashtests/1405880.html b/layout/style/crashtests/1405880.html
new file mode 100644
index 000000000000..aad53507a7b6
--- /dev/null
+++ b/layout/style/crashtests/1405880.html
@@ -0,0 +1,21 @@
+<style>
+input:invalid {}
+</style>
+<script>
+function eventhandler1() {
+try { htmlvar00005.select(); } catch(e) { }
+try { htmlvar00009.appendChild(htmlvar00004); } catch(e) { }
+try { htmlvar00013.innerText = ""; } catch(e) { }
+}
+function eventhandler2() {
+try { htmlvar00011.addEventListener("DOMSubtreeModified", eventhandler1); } catch(e) { }
+try { htmlvar00011.style.setProperty("text-transform", "full-width"); } catch(e) { }
+}
+</script>
+<marquee id="htmlvar00004">
+<input id="htmlvar00005" required="">
+</marquee>
+<form id="htmlvar00009">
+<legend id="htmlvar00011">
+<q id="htmlvar00013">
+<image onload="eventhandler2()" src="data:;base64,R0lGODlhIAAAAAAAACH5BAAAAAAALAAAAAgACAAAAO">
diff --git a/layout/style/crashtests/crashtests.list b/layout/style/crashtests/crashtests.list
index 79140a663070..88475ab58ea5 100644
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -252,6 +252,7 @@ load 1404324-1.html
 load 1404324-2.html
 load 1404324-3.html
 load 1404057.html
+load 1405880.html
 load 1409502.html
 load 1409931.html
 load 1410226-1.html