Bug 637214 - Test case; r=bzbarsky a=test-only

content/base/crashtests/637214-1.svg

@@ -0,0 +1,26 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" class="reftest-wait">
+
+<script>
+<![CDATA[
+
+window.addEventListener("load", function () {
+    document.documentElement.appendChild(document.getElementById("a"));
+    setTimeout(function () {
+        document.getElementById("x").setAttribute("id", "m1");
+        document.documentElement.removeAttribute("class");
+    }, 0);
+}, false);
+
+]]>
+</script>
+
+<g id="a">
+  <path id="x"/>
+  <text>
+    <textPath xlink:href="#m1">Text</textPath>
+    <textPath xlink:href="#m1">Text</textPath>
+
+  </text>
+</g>
+
+</svg>

content/base/crashtests/637214-2.svg

@@ -0,0 +1,26 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" class="reftest-wait">
+
+<script>
+<![CDATA[
+
+window.addEventListener("load", function () {
+    document.documentElement.appendChild(document.getElementById("a"));
+    setTimeout(function () {
+        document.getElementById("x").removeAttribute("id");
+        document.documentElement.removeAttribute("class");
+    }, 0);
+}, false);
+
+]]>
+</script>
+
+<g id="a">
+  <path id="x"/>
+  <text>
+    <textPath xlink:href="#m1">Text</textPath>
+    <textPath xlink:href="#m1">Text</textPath>
+
+  </text>
+</g>
+
+</svg>

content/base/crashtests/crashtests.list

@@ -86,3 +86,5 @@ load 593302-2.html
 load 610571-1.html
 load 604262-1.html
 load 628599-1.html
+load 637214-1.svg
+load 637214-2.svg