diff --git a/layout/base/crashtests/1156588.html b/layout/base/crashtests/1156588.html
new file mode 100644
index 000000000000..ed0098f79ad3
--- /dev/null
+++ b/layout/base/crashtests/1156588.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<!--
+user_pref("layout.css.grid.enabled", true);
+-->
+<script>
+
+function boom()
+{
+    document.documentElement.offsetHeight;
+    document.getElementById("x").style.content = "'x'";
+    document.documentElement.offsetHeight;
+    document.getElementById("s").remove();
+    document.documentElement.offsetHeight;
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<div style="display: inline-grid; white-space: pre;"><div id="x"><span>
+<span>
+</span><span id="s"></span></span></div></div>
+
+</body>
+</html>
diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list
index 0f8a8164f98a..dad17364f1c9 100644
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -463,3 +463,4 @@ load 1116104.html
 load 1107508-1.html
 load 1127198-1.html
 load 1140198.html
+pref(layout.css.grid.enabled,true) load 1156588.html
