LayoutTests/mathml/msubsup-fuzz.html

<script>
    if (window.testRunner)
        testRunner.dumpAsText();
</script>

<p>This test passes if it does not crash.</p>

<math><msubsup><mtext style="display: none"></mtext><mn>3</mn></msubsup></math>