Bug 1389645: Crashtest. r=me

MozReview-Commit-ID: BFJB3gm9IAS
2017-08-27 00:06:49 +02:00 · 2017-08-27 00:06:49 +02:00 · eee20b3f8b
--- a/layout/style/crashtests/1389645.html
+++ b/layout/style/crashtests/1389645.html
@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<meta charset="UTF-8">
+<script>
+window.onload = () => {
+  a = document.createElement("x")
+  document.documentElement.appendChild(a)
+  b = document.createElement("span")
+  document.documentElement.appendChild(b)
+  document.documentElement.getBoundingClientRect()
+  a.appendChild(document.createElement('div'))
+  b.innerText = "\uFDDE\r\u0301\n"
+}
+</script>
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@ -204,3 +204,4 @@ load 1387499.html
 load 1388234.html
 load 1391577.html
 load 1393580.html
+load 1389645.html