1 files changed, 28 insertions, 0 deletions
diff --git a/layout/base/crashtests/793848.html b/layout/base/crashtests/793848.html
new file mode 100644
index 0000000000..5d9bba2722
--- /dev/null
+++ b/layout/base/crashtests/793848.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+    function f(event) {
+        document.removeEventListener("DOMAttrModified", f, false);
+
+        // dumpln(event.attrChange); /* 2 (MutationEvent.ADDITION) */
+        // dumpln(event.attrName); /* "curpos" */
+        // dumpln(event.newValue); /* "0" */
+
+        // (gdb) break nsGlobalWindow::Dump
+        dump("[[[[DOMAttrModified\n");
+        document.removeChild(svgUse);
+        dump("]]]]\n");
+    }
+
+    var svgUse = document.createElementNS("http://www.w3.org/2000/svg", "use");
+    document.removeChild(document.documentElement);
+    document.addEventListener("DOMAttrModified", f, false);
+    document.appendChild(svgUse);
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>