new file mode 100644
--- /dev/null
+++ b/widget/src/cocoa/crashtests/464589-1.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ var o2 = document.createElement("option");
+ document.getElementById("o1").appendChild(o2);
+ o2.style.padding = "131072cm";
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<select><option id="o1" style="height: 0cm;"></option></select>
+
+</body>
+</html>
--- a/widget/src/cocoa/crashtests/crashtests.list
+++ b/widget/src/cocoa/crashtests/crashtests.list
@@ -1,7 +1,8 @@
load 397209-1.html
load 403296-1.xhtml
load 419737-1.html
load 444260-1.xul
load 444864-1.html
load 449111-1.html
load 460387-1.html
+load 464589-1.html
