diff --git a/layout/base/crashtests/386476.html b/layout/base/crashtests/386476.html
new file mode 100644
index 000000000000..744ee85e87d5
--- /dev/null
+++ b/layout/base/crashtests/386476.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html>
+	<head>
+		<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+		<title>bug 386476</title>
+	</head>
+	<body onload="setTimeout(function(){document.querySelector('textarea').setAttribute('dir','rtl')},0)">
+<textarea rows="8" cols="50" dir="ltr">text inside a textarea gone wild
+second line
+[url=http://bugzilla.mozilla.org/]טקסט[/url], [url=http://bugzilla.mozilla.org/]url[טקסט], [url=http://bugzilla.mozilla.org/]טקסט[/url].</textarea>
+	</body>
+</html>
diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list
index 3a527bdb6e4a..e65b94acb073 100644
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -166,6 +166,7 @@ load 385354.html
 load 385866-1.xhtml
 load 385880-1.xhtml
 load 386266-1.html
+load 386476.html
 load 387195-1.html
 load 387195-2.xhtml
 load 388715-1.html
