bug 398088 - crash test by Jesse Ruderman.

content/base/crashtests/398088-1.xul

@@ -0,0 +1,23 @@
+<window onload="boom();" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<script>
+
+function boom()
+{
+  var p = document.getElementById("p");
+  
+  document.addEventListener("DOMAttrModified", removeP, true); 
+  
+  p.removeAttribute("mode");
+  
+  function removeP()
+  {
+    document.documentElement.removeChild(p);
+  }
+}
+
+</script>
+
+<progressmeter id="p" mode="determined" />
+
+</window>

content/base/crashtests/crashtests.list

@@ -36,6 +36,7 @@ load 387460-1.html
 load 395469-1.xhtml
 load 395469-2.xhtml
 load 399712-1.html
+load 398088-1.xul
 load 400763-1.html
 load 407818.html
 load 410860-1.xml