diff --git a/mozilla/layout/base/crashtests/310267-1.xml b/mozilla/layout/base/crashtests/310267-1.xml
new file mode 100644
index 00000000000..fff0a65558c
--- /dev/null
+++ b/mozilla/layout/base/crashtests/310267-1.xml
@@ -0,0 +1,32 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="white-space: pre;" class="reftest-wait"><script><![CDATA[
+
+function init() { 
+  var docElt = document.documentElement;
+  var firstText = docElt.childNodes[1];
+  var div = docElt.childNodes[2];
+  var bidiText = div.childNodes[0];
+
+  function first() 
+  {
+    docElt.insertBefore(div, firstText);
+    docElt.insertBefore(bidiText, div);
+  }
+  
+  function second()
+  {
+    docElt.insertBefore(div, firstText);
+    docElt.appendChild(bidiText);
+    document.documentElement.removeAttribute("class");
+  }
+  
+  first();
+  setTimeout(second, 100);
+
+}
+
+window.addEventListener("load", init, false);
+
+]]></script>
+
+A<div>׳
+Z</div></html>
\ No newline at end of file
diff --git a/mozilla/layout/base/crashtests/crashtests.list b/mozilla/layout/base/crashtests/crashtests.list
index 8e9a8dfde2b..857c0d96523 100644
--- a/mozilla/layout/base/crashtests/crashtests.list
+++ b/mozilla/layout/base/crashtests/crashtests.list
@@ -3,6 +3,7 @@ load 143862-2.html
 load 243159-1.html
 load 243159-2.xhtml
 load 306940-1.html
+load 310267-1.xml
 load 310638-1.svg
 load 310638-2.html
 load 313086-1.xml
