bug 435209 - crash test by Martin Wargers.

content/svg/content/src/crashtests/435209-1.svg

@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<path/>
+
+<script xmlns="http://www.w3.org/1999/xhtml"><![CDATA[
+var x=document.getElementsByTagName('path')[0];
+var y = x.pathSegList;
+var z = x.createSVGPathSegMovetoRel(0,0);
+y.appendItem(z,0);
+y.replaceItem(z, 0);
+]]></script>
+</svg>

content/svg/content/src/crashtests/crashtests.list

@@ -40,4 +40,5 @@ load 414188-1.svg
 load 427325-1.svg
 load 428228-1.svg
 load 428841-1.svg
+load 435209-1.svg
 load 466576-1.xhtml