layout/mathml/crashtests/655451-1.xhtml
author Andrea Marchesini <amarchesini@mozilla.com>
Tue, 24 Oct 2017 14:38:23 +0200
changeset 387852 17c1e024efc2ac9dd1638c568d70c91548e986dc
parent 70352 3efdb67c20e7ecc01c5988aaea2466754517ec09
permissions -rw-r--r--
Bug 1409329 - NS_NewBufferedOutputStream should take the ownership of the outputStream, r=smaug

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script>

function boom()
{
  document.documentElement.style.fontStyle = "oblique";
  var c = document.getElementById("c");
  c.parentNode.removeChild(c);
}

</script>
</head>
<body onload="boom();"><math xmlns="http://www.w3.org/1998/Math/MathML"><frameset xmlns="http://www.w3.org/1999/xhtml"></frameset><msubsup id="c"/><mo><frameset xmlns="http://www.w3.org/1999/xhtml"></frameset></mo></math>x</body>
</html>