new file mode 100644
--- /dev/null
+++ b/layout/mathml/crashtests/400475-1.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function foo()
+{
+ document.getElementById("ms").setAttribute("foo", "x");
+}
+</script>
+</head>
+
+<body onload="foo()">
+
+<mstyle xmlns="http://www.w3.org/1998/Math/MathML" id="ms" />
+</body>
+
+</html>
--- a/layout/mathml/crashtests/crashtests.list
+++ b/layout/mathml/crashtests/crashtests.list
@@ -19,11 +19,11 @@ load 367107-1.html
load 368430-1.xhtml
load 370791-1.xhtml
load 372483-1.xhtml
load 375562-1.xhtml
load 377824-1.xhtml
load 379418-1.xhtml
load 393760-1.xhtml
load 397518-1.xhtml
+load 400475-1.xhtml
load 405187-1.xhtml
load 405271-1.xml
-
