Bug 612736: add crashtests for this WORKSFORME bug. r=longsonr

layout/svg/crashtests/612736-1.svg

@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     class="reftest-wait">
+  <path id="path"/>
+  <text>
+    <textPath xlink:href="#path">f</textPath>
+    <textPath xlink:href="#path">f</textPath>
+  </text>
+
+  <script>
+  function boom()
+  {
+    var path = document.getElementById("path");
+    path.parentNode.removeChild(path);
+    document.documentElement.removeAttribute("class");
+  }
+  window.addEventListener("load", boom, false);
+  </script>
+</svg>

layout/svg/crashtests/612736-2.svg

@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink">
+  <path id="path" d="M0 100 h50" stroke="black"/>
+  <text>
+    <textPath xlink:href="#path">abc</textPath>
+    <textPath xlink:href="#path">def</textPath>
+  </text>
+</svg>

layout/svg/crashtests/crashtests.list

@@ -106,6 +106,8 @@ load 610594-1.html
 load 610954-1.html
 load 612662-1.svg
 load 612662-2.svg
+load 612736-1.svg
+load 612736-2.svg
 load 614367-1.svg
 load 620034-1.html
 load 621598-1.svg
@@ -136,4 +138,3 @@ load 780963-1.html
 load 757751-1.svg
 load 790072.svg
 load 791826-1.svg
-