From 7f42e3826b991bd23bc6d8186fd9620442d233e4 Mon Sep 17 00:00:00 2001
From: Abhishek Arya <inferno@chromium.org>
Date: Wed, 10 Sep 2014 13:07:43 +0000
Subject: [PATCH] Bug 1061027 - crashtest.

---
 layout/mathml/crashtests/1061027.html    | 12 ++++++++++++
 layout/mathml/crashtests/crashtests.list |  1 +
 2 files changed, 13 insertions(+)
 create mode 100644 layout/mathml/crashtests/1061027.html

diff --git a/layout/mathml/crashtests/1061027.html b/layout/mathml/crashtests/1061027.html
new file mode 100644
index 000000000000..ee69c8ed07a0
--- /dev/null
+++ b/layout/mathml/crashtests/1061027.html
@@ -0,0 +1,12 @@
+<style>
+.c1 { transform-style: preserve-3d; display: table-row-group;</style><script>
+var docElement = document.documentElement;
+function init() {
+test1 = document.createElementNS("http://www.w3.org/1999/xhtml", "defs");
+test1.setAttribute("class", "c1");
+docElement.appendChild(test1);
+test2 = document.createElementNS("http://www.w3.org/1998/Math/MathML", "msub");
+test1.appendChild(test2);
+}
+document.addEventListener("DOMContentLoaded", init, false);
+</script>
\ No newline at end of file
diff --git a/layout/mathml/crashtests/crashtests.list b/layout/mathml/crashtests/crashtests.list
index f219ac58c18c..718aa1e0b263 100644
--- a/layout/mathml/crashtests/crashtests.list
+++ b/layout/mathml/crashtests/crashtests.list
@@ -63,3 +63,4 @@ test-pref(layout.css.sticky.enabled,true) load 973322-1.xhtml
 load 848725-1.html
 load 848725-2.html
 load 1028521-1.xhtml
+load 1061027.html