| <!DOCTYPE html> | |
| <script> | |
| if (window.testRunner) | |
| testRunner.dumpAsText(); | |
| var mtext = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mtext"); | |
| var docElt = document.documentElement; | |
| docElt.parentNode.removeChild(docElt); | |
| var textNode = document.createTextNode("Bug 100764: Heap-use-after-free in WebCore::RenderLayer::paintList [MathML]. This test passes if it does not crash."); | |
| mtext.appendChild(textNode); | |
| document.appendChild(mtext); | |
| </script> |