LayoutTests/mathml/empty-msubsup-crash.html - WebKit - Git at Google

 <html>
 <head>
 <script>
     if (window.testRunner)
         testRunner.dumpAsText();
 </script>
 </head>
 <body>

 <p>This test passes if it does not crash.</p>

 <math xmlns="http://www.w3.org/1998/Math/MathML">
     <msubsup></msubsup>
 </math>

 </body>
 </html>
	<html>
	<head>
	<script>
	if (window.testRunner)
	testRunner.dumpAsText();
	</script>
	</head>
	<body>

	<p>This test passes if it does not crash.</p>

	<math xmlns="http://www.w3.org/1998/Math/MathML">
	<msubsup></msubsup>
	</math>

	</body>
	</html>