<html xmlns="http://www.w3.org/1999/xhtml" xmlns:mathml="http://www.w3.org/1998/Math/MathML"> <title>Testcase bug - Crash [@ nsHTMLReflowState::GetNearestContainingBlock] with testcase using generated content, xbl and mathml</title> <bindings xmlns="http://www.mozilla.org/xbl"><binding id="a"> <content><children> <div xmlns="http://www.w3.org/1999/xhtml" style="position: absolute;"> <div style="position: absolute;"/> </div> </children></content> </binding></bindings> <style> mtable::after { content:"anonymous text"; } mtable::before { content:"before text"; } </style> <thead style="overflow: scroll;"> <mathml:mrow> <mathml:mtable> <tfoot style="-moz-binding: url(#a);" id="a_1"> <td style="-moz-binding: url(#a);"/> </tfoot> </mathml:mtable> <td id="a_2"/> </mathml:mrow> </thead> <script xmlns="http://www.w3.org/1999/xhtml"> function doe() { document.getElementById('a_1').style.borderCollapse = ""; document.documentElement.offsetHeight; document.getElementById('a_2').parentNode.removeChild(document.getElementById('a_2')); } setTimeout(doe, 400); </script> </html>