diff --git a/editor/libeditor/text/crashtests/580151-1.xhtml b/editor/libeditor/text/crashtests/580151-1.xhtml
new file mode 100644
index 00000000000..37994111170
--- /dev/null
+++ b/editor/libeditor/text/crashtests/580151-1.xhtml
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+var t;
+
+function boom()
+{
+  var b = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+  t = document.createElementNS("http://www.w3.org/1999/xhtml", "textarea");
+  b.appendChild(t);
+  document.removeChild(document.documentElement)
+  document.appendChild(b)
+  document.removeChild(document.documentElement)
+  var ns = document.createElementNS("http://www.w3.org/1999/xhtml", "script");
+  var nt = document.createTextNode("t.appendChild(document.createTextNode(' '));");
+  ns.appendChild(nt);
+  b.appendChild(ns);
+  document.appendChild(b);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/text/crashtests/crashtests.list b/editor/libeditor/text/crashtests/crashtests.list
index d5d24b06384..77fa4db9d93 100644
--- a/editor/libeditor/text/crashtests/crashtests.list
+++ b/editor/libeditor/text/crashtests/crashtests.list
@@ -1 +1,2 @@
 load 403965-1.xhtml
+load 580151-1.xhtml
