layout/mathml/crashtests/347507-1.xhtml
author Andrea Marchesini <amarchesini@mozilla.com>
Tue, 24 Oct 2017 14:38:23 +0200
changeset 387852 17c1e024efc2ac9dd1638c568d70c91548e986dc
parent 9338 3152ff87003ae652e4b3e9fd663c8e5d95022b11
permissions -rw-r--r--
Bug 1409329 - NS_NewBufferedOutputStream should take the ownership of the outputStream, r=smaug

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script>

function foo()
{
  var div = document.getElementById("div"); 
  div.appendChild(div.firstChild);
  
  var td = document.getElementById("td");
  td.setAttribute('rowspan', -2);
}

</script>

</head>

<body onload="foo()">


<div id="div"><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">

    <mtable>
      <mtr>
         <mtd id="td"><mi>y</mi></mtd>
      </mtr>
    </mtable>

</math></div>

</body>

</html>