diff --git a/layout/html/tests/style/bugs/bug348809-1.html b/layout/html/tests/style/bugs/bug348809-1.html
new file mode 100644
index 000000000000..4a151edf3056
--- /dev/null
+++ b/layout/html/tests/style/bugs/bug348809-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: green }
+:checked + span { color: red }
+input { display: none }
+</style>
+
+<body>
+<input checked="checked" id="foo"><span>There should be no red</span>
+</body>
+</html>
diff --git a/layout/html/tests/style/bugs/bug348809-10.html b/layout/html/tests/style/bugs/bug348809-10.html
new file mode 100644
index 000000000000..2ca0f7b360b6
--- /dev/null
+++ b/layout/html/tests/style/bugs/bug348809-10.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: green }
+:default + span { color: red }
+span.reverse { color: red }
+:default + span.reverse { color: green }
+button { display: none }
+</style>
+
+<body onload='document.getElementById("foo").setAttribute("type", "button");'>
+<form>
+<div>
+  <button type="submit" checked="checked" id="foo"></button>
+  <span>There should be no red.</span>
+</div>
+<div>
+  <button type="submit"></button><span class="reverse">There should be no red.</span>
+</div>
+</form>
+</body>
+</html>
diff --git a/layout/html/tests/style/bugs/bug348809-11.html b/layout/html/tests/style/bugs/bug348809-11.html
new file mode 100644
index 000000000000..e6cb0101a515
--- /dev/null
+++ b/layout/html/tests/style/bugs/bug348809-11.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: green }
+:default + span { color: red }
+span.reverse { color: red }
+:default + span.reverse { color: green }
+input { display: none }
+</style>
+
+<body onload='document.getElementById("foo").removeAttribute("type"); document.getElementById("bar").setAttribute("type", "checkbox");'>
+<form>
+<div>
+  <input type="checkbox" checked="checked" id="foo">
+  <span>There should be no red.</span>
+</div>
+<div>
+  <input checked="checked" id="bar">
+  <span class="reverse">There should be no red.</span>
+</div>
+</form>
+</body>
+</html>
diff --git a/layout/html/tests/style/bugs/bug348809-12.html b/layout/html/tests/style/bugs/bug348809-12.html
new file mode 100644
index 000000000000..8abda6d0d4c3
--- /dev/null
+++ b/layout/html/tests/style/bugs/bug348809-12.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: green }
+:default + span { color: red }
+span.reverse { color: red }
+:default + span.reverse { color: green }
+input { display: none }
+</style>
+
+<body onload='document.getElementById("foo").removeAttribute("type"); document.getElementById("bar").setAttribute("type", "radio");'>
+<form>
+<div>
+  <input type="radio" checked="checked" id="foo">
+  <span>There should be no red.</span>
+</div>
+<div>
+  <input checked="checked" id="bar">
+  <span class="reverse">There should be no red.</span>
+</div>
+</form>
+</body>
+</html>
diff --git a/layout/html/tests/style/bugs/bug348809-13.html b/layout/html/tests/style/bugs/bug348809-13.html
new file mode 100644
index 000000000000..d14090b03ad3
--- /dev/null
+++ b/layout/html/tests/style/bugs/bug348809-13.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: green }
+:default:checked + span { color: red }
+input { display: none }
+</style>
+
+<body onload='dump("aaa"); document.getElementById("foo").setAttribute("type", "submit");'>
+<form>
+<div>
+  <input type="submit">
+  <input type="radio" checked="checked" id="foo">
+  <span>There should be no red.</span>
+</div>
+</form>
+</body>
+</html>
diff --git a/layout/html/tests/style/bugs/bug348809-2.html b/layout/html/tests/style/bugs/bug348809-2.html
new file mode 100644
index 000000000000..16f023bd7c87
--- /dev/null
+++ b/layout/html/tests/style/bugs/bug348809-2.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: red }
+:checked + span { color: green }
+input { display: none }
+</style>
+
+<body>
+<input type="checkbox" checked="checked" id="foo"><span>There should be no red</span>
+</body>
+</html>
diff --git a/layout/html/tests/style/bugs/bug348809-3.html b/layout/html/tests/style/bugs/bug348809-3.html
new file mode 100644
index 000000000000..e9555808c8ac
--- /dev/null
+++ b/layout/html/tests/style/bugs/bug348809-3.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: red }
+:default + span { color: green }
+span.reverse { color: green }
+:default + span.reverse { color: red }
+input { display: none }
+</style>
+
+<body>
+<form>
+<div>
+  <input type="submit" checked="checked" id="foo"><span>There should be no red.</span>
+</div>
+<div>
+  <input type="submit"><span class="reverse">There should be no red.</span>
+</div>
+</form>
+</body>
+</html>
diff --git a/layout/html/tests/style/bugs/bug348809-4.html b/layout/html/tests/style/bugs/bug348809-4.html
new file mode 100644
index 000000000000..305807391b6d
--- /dev/null
+++ b/layout/html/tests/style/bugs/bug348809-4.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: red }
+:default + span { color: green }
+span.reverse { color: green }
+:default + span.reverse { color: red }
+button { display: none }
+</style>
+
+<body>
+<form>
+<div>
+  <button type="submit" checked="checked" id="foo"></button>
+  <span>There should be no red.</span>
+</div>
+<div>
+  <button type="submit"></button><span class="reverse">There should be no red.</span>
+</div>
+</form>
+</body>
+</html>
diff --git a/layout/html/tests/style/bugs/bug348809-5.html b/layout/html/tests/style/bugs/bug348809-5.html
new file mode 100644
index 000000000000..e21074b3abd5
--- /dev/null
+++ b/layout/html/tests/style/bugs/bug348809-5.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: red }
+:default + span { color: green }
+span.reverse { color: green }
+:default + span.reverse { color: red }
+input { display: none }
+</style>
+
+<body>
+<form>
+<div>
+  <input type="checkbox" checked="checked" id="foo">
+  <span>There should be no red.</span>
+</div>
+<div>
+  <input checked="checked"><span class="reverse">There should be no red.</span>
+</div>
+</form>
+</body>
+</html>
diff --git a/layout/html/tests/style/bugs/bug348809-6.html b/layout/html/tests/style/bugs/bug348809-6.html
new file mode 100644
index 000000000000..c26f64fbf3c5
--- /dev/null
+++ b/layout/html/tests/style/bugs/bug348809-6.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: red }
+:default + span { color: green }
+span.reverse { color: green }
+:default + span.reverse { color: red }
+input { display: none }
+</style>
+
+<body>
+<form>
+<div>
+  <input type="radio" checked="checked" id="foo">
+  <span>There should be no red.</span>
+</div>
+<div>
+  <input checked="checked"><span class="reverse">There should be no red.</span>
+</div>
+</form>
+</body>
+</html>
diff --git a/layout/html/tests/style/bugs/bug348809-7.html b/layout/html/tests/style/bugs/bug348809-7.html
new file mode 100644
index 000000000000..6a3c59d7152f
--- /dev/null
+++ b/layout/html/tests/style/bugs/bug348809-7.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: green }
+:checked + span { color: red }
+input { display: none }
+</style>
+
+<body onload='document.getElementById("foo").removeAttribute("type");'>
+<input type="checkbox" checked="checked" id="foo"><span>There should be no red</span>
+</body>
+</html>
diff --git a/layout/html/tests/style/bugs/bug348809-8.html b/layout/html/tests/style/bugs/bug348809-8.html
new file mode 100644
index 000000000000..b765e9aa7893
--- /dev/null
+++ b/layout/html/tests/style/bugs/bug348809-8.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: red }
+:checked + span { color: green }
+input { display: none }
+</style>
+
+<body onload='document.getElementById("foo").setAttribute("type", "checkbox");'>
+<input checked="checked" id="foo"><span>There should be no red</span>
+</body>
+</html>
diff --git a/layout/html/tests/style/bugs/bug348809-9.html b/layout/html/tests/style/bugs/bug348809-9.html
new file mode 100644
index 000000000000..5b5f574f808a
--- /dev/null
+++ b/layout/html/tests/style/bugs/bug348809-9.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: green }
+:default + span { color: red }
+span.reverse { color: red }
+:default + span.reverse { color: green }
+input { display: none }
+</style>
+
+<body onload='document.getElementById("foo").removeAttribute("type");'>
+<form>
+<div>
+  <input type="submit" checked="checked" id="foo"><span>There should be no red.</span>
+</div>
+<div>
+  <input type="submit"><span class="reverse">There should be no red.</span>
+</div>
+</form>
+</body>
+</html>
diff --git a/layout/html/tests/style/bugs/rtest.lst b/layout/html/tests/style/bugs/rtest.lst
index dd2a85383148..127a180a111b 100644
--- a/layout/html/tests/style/bugs/rtest.lst
+++ b/layout/html/tests/style/bugs/rtest.lst
@@ -4,3 +4,16 @@ bug273719.html
 bug84400-1.html
 bug84400-2.html
 bug84400-3.html
+bug348809-1.html
+bug348809-2.html
+bug348809-3.html
+bug348809-4.html
+bug348809-5.html
+bug348809-6.html
+bug348809-7.html
+bug348809-8.html
+bug348809-9.html
+bug348809-10.html
+bug348809-11.html
+bug348809-12.html
+bug348809-13.html
