test for bug 832644

content/base/crashtests/832644.html

@@ -0,0 +1,8 @@
+<x6 id=test1>><bdi id=test2><fieldset id=test3>>ohVG	l0ci * |X5SEX :GdK5i2rC#sdnwJv0%O{QF Lh>>><ol id=test4><script>
+var docElement = document.documentElement;
+document.addEventListener("DOMContentLoaded", CFcrash, false);
+function CFcrash() {
+try { test2.setAttribute("dir", "auto"); } catch(e) {}
+try { test3.innerHTML = test4.innerHTML; } catch(e) {}
+setTimeout('docElement.insertBefore(test1, docElement.firstChild);', 2);
+}</script>>

content/base/crashtests/crashtests.list

@@ -130,6 +130,7 @@ load 827190.html
 load 828054.html
 load 829428.html
 load 830098.html
+load 832644.html
 load 836890.html
 load 838489-1.html
 load 838489-2.html