Bug 1405880: Crashtest. r=emilio

MozReview-Commit-ID: GPvmVmH9t74

layout/style/crashtests/1405880.html

@@ -0,0 +1,21 @@
+<style>
+input:invalid {}
+</style>
+<script>
+function eventhandler1() {
+try { htmlvar00005.select(); } catch(e) { }
+try { htmlvar00009.appendChild(htmlvar00004); } catch(e) { }
+try { htmlvar00013.innerText = ""; } catch(e) { }
+}
+function eventhandler2() {
+try { htmlvar00011.addEventListener("DOMSubtreeModified", eventhandler1); } catch(e) { }
+try { htmlvar00011.style.setProperty("text-transform", "full-width"); } catch(e) { }
+}
+</script>
+<marquee id="htmlvar00004">
+<input id="htmlvar00005" required="">
+</marquee>
+<form id="htmlvar00009">
+<legend id="htmlvar00011">
+<q id="htmlvar00013">
+<image onload="eventhandler2()" src="data:;base64,R0lGODlhIAAAAAAAACH5BAAAAAAALAAAAAgACAAAAO">

layout/style/crashtests/crashtests.list

@@ -252,6 +252,7 @@ load 1404324-1.html
 load 1404324-2.html
 load 1404324-3.html
 load 1404057.html
+load 1405880.html
 load 1409502.html
 load 1409931.html
 load 1410226-1.html