diff --git a/layout/generic/crashtests/1003441.xul b/layout/generic/crashtests/1003441.xul
new file mode 100644
index 00000000000..998f5ca9823
--- /dev/null
+++ b/layout/generic/crashtests/1003441.xul
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="setTimeout(boom,0,1)">
+
+<splitter style="all: inherit;">
+    <box/>
+    <box/>
+    <box/>
+    <box/>
+    <iframe id="a" src="aaa"/>
+</splitter>
+
+<script id="script" xmlns="http://www.w3.org/1999/xhtml">
+
+    <![CDATA[//<![CDATA[
+
+var doc = document;
+function boom(i) {
+  if (i>6)
+    return;
+  var x=doc.getElementsByTagName('*');
+  if (x[i] && x[i+1]) {
+    var temp = x[i+1].getAttribute('style');
+    x[i+1].setAttribute('style', x[i].getAttribute('style'));
+    x[i].setAttribute('style', temp);
+  } else { 
+    return;
+  }
+  i++;
+  setTimeout(boom,50,i);
+}
+
+//]]>
+
+    </script>
+
+    </window>
diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list
index 48352a39a64..3de7b00f946 100644
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -559,6 +559,7 @@ load 973701-2.xhtml
 load 986899.html
 load 1001233.html
 load 1001258-1.html
+load 1003441.xul
 pref(layout.css.grid.enabled,true) load 1015562.html
 asserts(1-2) load 1015563-1.html
 asserts(1-2) load 1015563-2.html
diff --git a/layout/generic/nsSubDocumentFrame.cpp b/layout/generic/nsSubDocumentFrame.cpp
index b83e6feabd1..f2348731404 100644
--- a/layout/generic/nsSubDocumentFrame.cpp
+++ b/layout/generic/nsSubDocumentFrame.cpp
@@ -937,7 +937,7 @@ public:
     if (!mPresShell->IsDestroying()) {
       mPresShell->FlushPendingNotifications(Flush_Frames);
     }
-    nsIFrame* frame = mFrameElement->GetPrimaryFrame();
+    nsSubDocumentFrame* frame = do_QueryFrame(mFrameElement->GetPrimaryFrame());
     if ((!frame && mHideViewerIfFrameless) ||
         mPresShell->IsDestroying()) {
       // Either the frame element has no nsIFrame or the presshell is being