From ac55bf5738be7c18529d2b7970ee1f0de5c03a76 Mon Sep 17 00:00:00 2001
From: "jruderman@hmc.edu" <jruderman@hmc.edu>
Date: Sun, 16 Dec 2007 21:37:16 -0800
Subject: [PATCH] To boldly go where no crashtest has gone before.

---
 layout/svg/crashtests/364688-1.svg    | 34 +++++++++++++++++++++++++++
 layout/svg/crashtests/crashtests.list |  1 +
 2 files changed, 35 insertions(+)
 create mode 100644 layout/svg/crashtests/364688-1.svg

diff --git a/layout/svg/crashtests/364688-1.svg b/layout/svg/crashtests/364688-1.svg
new file mode 100644
index 00000000000..045061cd2f2
--- /dev/null
+++ b/layout/svg/crashtests/364688-1.svg
@@ -0,0 +1,34 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:html="http://www.w3.org/1999/xhtml"
+     onload="setTimeout(boom, 30);"
+     class="reftest-wait">
+
+<script>
+function boom()
+{
+  document.getElementById("sss").removeAttribute('value');
+
+  document.documentElement.removeAttribute("class");
+}
+</script>
+
+
+<foreignObject width="500" height="500" y="300">
+
+<div xmlns="http://www.w3.org/1999/xhtml">
+
+<table border="1">
+ <tr>
+  <td>Foo</td>
+ </tr>
+ <tr>
+  <td><input type="text" value="Baz" id="sss" /></td>
+ </tr>
+</table>
+
+</div>
+
+</foreignObject>
+
+
+</svg>
diff --git a/layout/svg/crashtests/crashtests.list b/layout/svg/crashtests/crashtests.list
index e88cee38c93..dcc7f1130bf 100644
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -26,6 +26,7 @@ load 359516-1.svg
 load 361015-1.svg
 load 361587-1.svg
 load 363611-1.xhtml
+load 364688-1.svg
 load 366956-1.svg
 load 366956-2.svg
 load 367111-1.svg