diff -r 000000000000 -r 6474c204b198 layout/svg/crashtests/873806-1.svg
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/layout/svg/crashtests/873806-1.svg	Wed Dec 31 06:09:35 2014 +0100
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <foreignObject requiredFeatures="fail">
+    <svg>
+      <text>a</text>
+    </svg>
+  </foreignObject>
+  <script>
+    document.querySelector("text").getBBox();
+  </script>
+</svg>