diff --git a/layout/mathml/crashtests/353612-1.xhtml b/layout/mathml/crashtests/353612-1.xhtml
new file mode 100644
index 00000000000..386e66f933d
--- /dev/null
+++ b/layout/mathml/crashtests/353612-1.xhtml
@@ -0,0 +1,17 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function foo()
+{
+  document.getElementById("ms").setAttribute("lquote", "'");
+}
+</script>
+</head>
+
+<body onload="foo()">
+
+<mtr xmlns="http://www.w3.org/1998/Math/MathML" />
+<mstyle xmlns="http://www.w3.org/1998/Math/MathML" id="ms" />
+</body>
+
+</html>
diff --git a/layout/mathml/crashtests/402400-1.xhtml b/layout/mathml/crashtests/402400-1.xhtml
new file mode 100644
index 00000000000..8a2a927533c
--- /dev/null
+++ b/layout/mathml/crashtests/402400-1.xhtml
@@ -0,0 +1,41 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var textB = document.createTextNode("b");
+  var textC = document.createTextNode("c");
+  var textN = document.createTextNode("n");
+  var textP = document.createTextNode("p");
+  
+  var blv = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+  var odj = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+  var tr = document.createElementNS("http://www.w3.org/1999/xhtml", "tr");
+  var td = document.createElementNS("http://www.w3.org/1999/xhtml", "td");
+  var mathMO = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mo");
+  
+  td.appendChild(textB);
+  document.body.appendChild(blv);
+  blv.appendChild(tr);
+  blv.appendChild(mathMO);
+  mathMO.appendChild(textP);
+  odj.appendChild(td);
+  odj.appendChild(textN);
+
+  blv.removeChild(tr);
+  mathMO.appendChild(odj);
+  td.removeChild(textB);
+  blv.appendChild(textC);
+  document.body.appendChild(odj);
+  odj.insertBefore(mathMO, textN);
+  document.body.appendChild(mathMO);
+  mathMO.appendChild(odj);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+
+</html>
diff --git a/layout/mathml/crashtests/crashtests.list b/layout/mathml/crashtests/crashtests.list
index 2aa3dedd1de..af5a0d1a329 100644
--- a/layout/mathml/crashtests/crashtests.list
+++ b/layout/mathml/crashtests/crashtests.list
@@ -12,6 +12,7 @@ load 347507-1.xhtml
 load 348492-1.xhtml
 load 348811-1.xhtml
 load 348811-2.xhtml
+load 353612-1.xhtml
 load 355986-1.xhtml
 load 364685-1.xhtml
 load 366012-1.xhtml
@@ -25,5 +26,6 @@ load 379418-1.xhtml
 load 393760-1.xhtml
 load 397518-1.xhtml
 load 400475-1.xhtml
+load 402400-1.xhtml
 load 405187-1.xhtml
 load 405271-1.xml
