diff --git a/layout/base/crashtests/534768-1.html b/layout/base/crashtests/534768-1.html
new file mode 100644
index 00000000000..17c9ac68fe0
--- /dev/null
+++ b/layout/base/crashtests/534768-1.html
@@ -0,0 +1,23 @@
+<html style="direction: rtl;">
+<head>
+<style>
+
+body:after { content: '0'; }
+body:first-letter { float: right; }
+
+</style>
+<script>
+
+function boom()
+{
+  document.documentElement.style.direction = "";
+  document.documentElement.offsetHeight;  
+  document.documentElement.style.textIndent = "3px";
+}
+
+</script>
+</head>
+
+<body onload="boom();"> &#x202E;</body>
+
+</html>
diff --git a/layout/base/crashtests/534768-2.html b/layout/base/crashtests/534768-2.html
new file mode 100644
index 00000000000..67ecb4b6bd9
--- /dev/null
+++ b/layout/base/crashtests/534768-2.html
@@ -0,0 +1,22 @@
+<html style="direction: rtl;">
+<head>
+<style>
+
+body:first-letter { float: right; }
+
+</style>
+<script>
+
+function boom()
+{
+  document.documentElement.style.direction = "";
+  document.documentElement.offsetHeight;  
+  document.documentElement.style.textIndent = "3px";
+}
+
+</script>
+</head>
+
+<body onload="boom();"> &#x202E;</body>
+
+</html>
diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list
index 9b6996f6135..893f45a2a88 100644
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -281,6 +281,8 @@ load 522374-1.html
 load 522374-2.html
 load 526378-1.xul
 load 534367-1.xhtml
+load 534768-1.html
+load 534768-2.html
 load 535721-1.xhtml
 load 535911-1.xhtml
 load 536623-1.xhtml
