diff -r 000000000000 -r 6474c204b198 layout/svg/crashtests/359516-1.svg
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/layout/svg/crashtests/359516-1.svg	Wed Dec 31 06:09:35 2014 +0100
@@ -0,0 +1,36 @@
+<svg xmlns="http://www.w3.org/2000/svg" 
+     xmlns:html="http://www.w3.org/1999/xhtml"
+     class="reftest-wait"
+     onload="setTimeout(doStuff, 30);">
+
+<html:script style="display: none;" type="text/javascript">
+
+function doStuff()
+{
+  var svg = document.documentElement;
+  var ellipse = document.getElementById("ellipse");
+  var filter = document.getElementById("filter");
+
+  document.addEventListener("DOMNodeRemoved", foopy, false);
+  filter.removeChild(filter.firstChild);
+  document.removeEventListener("DOMNodeRemoved", foopy, false);
+  
+  function foopy()
+  {
+    document.removeEventListener("DOMNodeRemoved", foopy, false);
+    svg.appendChild(filter);
+  }
+
+  // Needed for the crash, but not for the assertion.
+  svg.appendChild(ellipse);
+  
+  document.documentElement.removeAttribute("class");
+}
+
+</html:script>
+
+<ellipse id="ellipse" cx="200" cy="150" rx="70" ry="40" style="filter: url(#filter);"/>
+
+<filter id="filter"> </filter>
+
+</svg>