diff --git a/content/base/crashtests/336381-1.xhtml b/content/base/crashtests/336381-1.xhtml
new file mode 100644
index 000000000000..eac3eeb57a22
--- /dev/null
+++ b/content/base/crashtests/336381-1.xhtml
@@ -0,0 +1,29 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+  var zz = document.getElementById("d").childNodes[0];
+
+  zz.parentNode.removeChild(zz);
+
+  var r = document.createRange();
+  r.setStart(zz, 0);
+  r.setEnd(zz, 0);
+
+  try {
+    r.insertNode(document.createTextNode('5'));
+  } catch (e) {
+  }
+}
+
+</script>
+</head>
+
+<body onload="boom()">
+
+<div id="d">3</div>
+
+</body>
+</html>
diff --git a/content/base/crashtests/336715-1.xhtml b/content/base/crashtests/336715-1.xhtml
new file mode 100644
index 000000000000..ad9d1430ad76
--- /dev/null
+++ b/content/base/crashtests/336715-1.xhtml
@@ -0,0 +1,40 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+<![CDATA[
+
+function funn()
+{
+  var q = document.getElementById("q");
+
+  var start1 = document.getElementById("start1");
+  var end1 = document.getElementById("end1");
+
+  var start2 = q; // div
+  var end2 = q.previousSibling; // text node
+
+  var r = document.createRange();
+  r.setStart(start1, 0);
+  r.setEnd(end1, 0);
+  r.deleteContents();
+  
+  // the offsets for start2 and end2 must be the same to trigger the assertion
+  var s = document.createRange();
+  s.setStart(start2, 0);
+  s.setEnd(end2, 0);
+  
+  document.documentElement.removeAttribute("class");
+}
+
+]]>
+</script>
+
+</head>
+
+<body onload="setTimeout(funn, 30)">
+  <div id="start1"></div>
+  <div id="t">X<div id="q">Y</div></div>
+  <div id="end1"></div>
+</body>
+
+</html>
diff --git a/content/base/crashtests/crashtests.list b/content/base/crashtests/crashtests.list
index 4821fc484f0b..36f3688ae796 100644
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@@ -5,6 +5,8 @@ load 326646-1.html
 load 326778-1.html
 load 326865-1.html
 load 330925-1.xhtml
+load 336381-1.xhtml
+load 336715-1.xhtml
 load 338391-1.xhtml
 load 340733-1.html
 load 343730-1.xhtml
