diff --git a/mozilla/editor/composer/src/crashtests/428844-1-inner.xhtml b/mozilla/editor/composer/src/crashtests/428844-1-inner.xhtml
new file mode 100644
index 00000000000..905d38e2d8f
--- /dev/null
+++ b/mozilla/editor/composer/src/crashtests/428844-1-inner.xhtml
@@ -0,0 +1,4 @@
+<?xml-stylesheet type="text/xsl" href="#a"?>
+<html xmlns="http://www.w3.org/1999/xhtml" onload="window.location.reload()" contenteditable="true">
+<xsl:stylesheet version="1.0" id="a" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"/>
+</html>
diff --git a/mozilla/editor/composer/src/crashtests/428844-1.html b/mozilla/editor/composer/src/crashtests/428844-1.html
new file mode 100644
index 00000000000..11143ab72a8
--- /dev/null
+++ b/mozilla/editor/composer/src/crashtests/428844-1.html
@@ -0,0 +1,13 @@
+<html>
+<head>
+<script>
+function boom() {
+  var iframe = document.getElementById('inner');
+  iframe.src = iframe.src;
+}
+</script>
+</head>
+<body onload="boom()">
+<iframe src="428844-1-inner.xhtml" id="inner">
+</body>
+</html>
diff --git a/mozilla/editor/composer/src/crashtests/crashtests.list b/mozilla/editor/composer/src/crashtests/crashtests.list
new file mode 100644
index 00000000000..288ff8364e2
--- /dev/null
+++ b/mozilla/editor/composer/src/crashtests/crashtests.list
@@ -0,0 +1 @@
+load 428844-1.html
diff --git a/mozilla/editor/composer/src/nsEditingSession.cpp b/mozilla/editor/composer/src/nsEditingSession.cpp
index 269fd06db57..3110ba142c4 100644
--- a/mozilla/editor/composer/src/nsEditingSession.cpp
+++ b/mozilla/editor/composer/src/nsEditingSession.cpp
@@ -573,7 +573,8 @@ nsEditingSession::TearDownEditorOnWindow(nsIDOMWindow *aWindow)
   rv = editorDocShell->GetEditor(getter_AddRefs(editor));
   NS_ENSURE_SUCCESS(rv, rv);
 
-  htmlDoc->TearingDownEditor(editor);
+  if (stopEditing)
+    htmlDoc->TearingDownEditor(editor);
 
   // null out the editor on the controllers first to prevent their weak 
   // references from pointing to a destroyed editor
diff --git a/mozilla/testing/crashtest/crashtests.list b/mozilla/testing/crashtest/crashtests.list
index c86d988da3e..c20eafb3792 100644
--- a/mozilla/testing/crashtest/crashtests.list
+++ b/mozilla/testing/crashtest/crashtests.list
@@ -25,6 +25,7 @@ include ../../dom/src/jsurl/crashtests/crashtests.list
 
 include ../../editor/libeditor/html/crashtests/crashtests.list
 include ../../editor/libeditor/base/crashtests/crashtests.list
+include ../../editor/composer/src/crashtests/crashtests.list
 
 include ../../intl/lwbrk/src/crashtests/crashtests.list
 
