1.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000 1.2 +++ b/layout/mathml/crashtests/307839-2.xhtml Wed Dec 31 06:09:35 2014 +0100 1.3 @@ -0,0 +1,24 @@ 1.4 +<?xml version="1.0"?> 1.5 +<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1 plus MathML 2.0//EN" "http://www.w3.org/TR/MathML2/dtd/xhtml-math11-f.dtd" [ 1.6 + <!ENTITY mathml "http://www.w3.org/1998/Math/MathML"> 1.7 +]> 1.8 +<html xmlns="http://www.w3.org/1999/xhtml"> 1.9 + 1.10 +<head> 1.11 +<title>Testcase bug - Evil mrow:hover testcase crashes Mozilla</title> 1.12 +<style type="text/css"> 1.13 +#h:hover{display:block;} 1.14 +</style> 1.15 +</head> 1.16 +<body onload="document.getElementById('mrow').setAttribute('id', 'h');"> 1.17 +<math mode="display" xmlns="http://www.w3.org/1998/Math/MathML"> 1.18 +<mover> 1.19 + <mrow id="mrow">hovering over this should not crash Mozilla</mrow> 1.20 + <mover> 1.21 + <mo>10</mo> 1.22 + <mrow>times</mrow> 1.23 + </mover> 1.24 +</mover> 1.25 +</math> 1.26 +</body> 1.27 +</html>