1 files changed, 31 insertions, 0 deletions
diff --git a/layout/mathml/crashtests/348811-2.xhtml b/layout/mathml/crashtests/348811-2.xhtml
new file mode 100644
index 000000000..30f7943a9
--- /dev/null
+++ b/layout/mathml/crashtests/348811-2.xhtml
@@ -0,0 +1,31 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function foo()
+{
+  var m = "http://www.w3.org/1998/Math/MathML";
+  var newTable = document.createElementNS(m, "mtable")
+  document.getElementById("mtable").appendChild(newTable);
+}
+</script>
+</head>
+
+<body onload="foo()">
+
+
+<div>
+  <math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+    <mtable id="mtable">
+      <mtr id="mtr">
+         <mtd>
+           <mi>x</mi>
+         </mtd>
+      </mtr>
+    </mtable>
+  </math>
+</div>
+     
+
+</body>
+
+</html>
+\ No newline at end of file