Crashtest for bug 405271.

2008-01-14 17:15:35 -08:00 · 2008-01-14 17:15:35 -08:00 · 79c6735016
--- a/layout/mathml/crashtests/405271-1.xml
+++ b/layout/mathml/crashtests/405271-1.xml
@ -0,0 +1,36 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<head>
+
+<style type="text/css">
+#q { width: 16px; height: 16px; }
+#a, #b { counter-increment: chicken; }
+</style>
+
+<style id="s" type="text/css">
+#a { content: 'x'; }
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+  remove(document.getElementById("s"));
+  remove(document.getElementById("b"));
+}
+
+function remove(n)
+{ 
+  n.parentNode.removeChild(n);
+}
+
+</script>
+
+</head>
+
+<body onload="boom();">
+
+<m:mrow id="a"/><m:mo id="q"><m:malignmark><m:msubsup/><m:munderover/><m:munder id="b"/></m:malignmark></m:mo>
+
+</body>
+
+</html>
--- a/layout/mathml/crashtests/crashtests.list
+++ b/layout/mathml/crashtests/crashtests.list
@ -24,3 +24,5 @@ load 377824-1.xhtml
 load 379418-1.xhtml
 load 397518-1.xhtml
 load 405187-1.xhtml
+load 405271-1.xml
+