Test for bug 830098

content/base/crashtests/830098.html

@@ -0,0 +1,14 @@
+<canvas dir=auto><p id=test1> 
+
+
+nt/b|+K	 E:</p>
+    <svg>
+        <defs id=test2>~ N LRWue`N6g J`NfT Ai0 BG  q QPX6 ~	 #A?ORD
+            <span><metadata id=test4><use id=test3>>>><script>
+var docElement = document.body ? document.body : document.documentElement;
+document.addEventListener("DOMContentLoaded", CFcrash, false);
+function CFcrash() {
+try { test1.parentNode.removeChild(test1); } catch(e) {}
+try { test2.innerHTML = ''; } catch(e) {}
+try { test3.outerHTML = test4.outerHTML; } catch(e) {}
+}</script>

content/base/crashtests/crashtests.list

@@ -129,6 +129,7 @@ load 824719.html
 load 827190.html
 load 828054.html
 load 829428.html
+load 830098.html
 load 836890.html
 load 838489-1.html
 load 838489-2.html