2 files changed, 14 insertions, 0 deletions
diff --git a/components/script/dom/testbinding.rs b/components/script/dom/testbinding.rs
index 95341751780..bbbbc8aa5d6 100644
--- a/components/script/dom/testbinding.rs
+++ b/components/script/dom/testbinding.rs
@@ -571,6 +571,15 @@ impl TestBindingMethods for TestBinding {
     fn FuncControlledAttributeEnabled(&self) -> bool { false }
     fn FuncControlledMethodDisabled(&self) {}
     fn FuncControlledMethodEnabled(&self) {}
+
+    #[allow(unsafe_code)]
+    fn CrashHard(&self) {
+        static READ_ONLY_VALUE: i32 = 0;
+        unsafe {
+            let p: *mut u32 = &READ_ONLY_VALUE as *const _ as *mut _;
+            ptr::write_volatile(p, 0xbaadc0de);
+        }
+    }
 }
 
 impl TestBinding {
diff --git a/components/script/dom/webidls/TestBinding.webidl b/components/script/dom/webidls/TestBinding.webidl
index cdfb9fd18ae..eb6e5a9ae7b 100644
--- a/components/script/dom/webidls/TestBinding.webidl
+++ b/components/script/dom/webidls/TestBinding.webidl
@@ -456,3 +456,8 @@ interface TestBinding {
   [Func="TestBinding::condition_satisfied"]
   const unsigned short funcControlledConstEnabled = 0;
 };
+
+partial interface TestBinding {
+  [Pref="dom.testable_crash.enabled"]
+  void crashHard();
+};