<!DOCTYPE html>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();

    var mtext = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mtext");

    var docElt = document.documentElement;
    docElt.parentNode.removeChild(docElt);

    var textNode = document.createTextNode("Bug 100764: Heap-use-after-free in WebCore::RenderLayer::paintList [MathML]. This test passes if it does not crash.");
    mtext.appendChild(textNode);

    document.appendChild(mtext);
</script>