What happens in crashtest, stays in crashtest.

2007-12-17 17:00:12 -08:00 · 2007-12-17 17:00:12 -08:00 · 8876b86705
--- a/layout/mathml/crashtests/347495-1.xhtml
+++ b/layout/mathml/crashtests/347495-1.xhtml
@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+
+<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+  <munderover>
    <mo>&#x0220F;</mo>
    <mn>1</mn>
  </munderover>
+</math></div>        
+
+</body>
+
+</html>
--- a/layout/mathml/crashtests/347507-1.xhtml
+++ b/layout/mathml/crashtests/347507-1.xhtml
@ -0,0 +1,29 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function foo()
+{
+  var div = document.getElementById("div"); 
+  div.appendChild(div.firstChild);
+  
+  var td = document.getElementById("td");
+  td.setAttribute('rowspan', -2);
+}
+
+</script>
+
+</head>
+
+<body onload="foo()">
+
+
+<div id="div"><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+
+    <mtable>
      <mtr>
         <mtd id="td"><mi>y</mi></mtd>
      </mtr>
    </mtable>
+
+</math></div>
+
+</body>
+
+</html>
--- a/layout/mathml/crashtests/crashtests.list
+++ b/layout/mathml/crashtests/crashtests.list
@ -6,3 +6,5 @@ load 323737-1.xml
 load 323738-1.xml
 load 323741-1.xml
 load 323742-1.xml
+load 347495-1.xhtml
+load 347507-1.xhtml