1 files changed, 19 insertions, 0 deletions
diff --git a/layout/style/crashtests/1395719.html b/layout/style/crashtests/1395719.html
new file mode 100644
index 0000000000..5cb4aa0c7a
--- /dev/null
+++ b/layout/style/crashtests/1395719.html
@@ -0,0 +1,19 @@
+<script>
+o = []
+window.onload = () => {
+  a = document.createElement("body");
+  b = document.createElementNS("http://www.w3.org/1998/Math/MathML", "math");
+  b.setAttributeNS(null, "display", "block");
+  c = document.createElementNS("http://www.w3.org/1998/Math/MathML", "munderover");
+  d = document.createTextNode("\n          ");
+  c.appendChild(d);
+  c.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", "mo"));
+  b.appendChild(c);
+  a.appendChild(b);
+  document.documentElement.appendChild(a);
+  a.style.display = "inline";
+  setTimeout(() => {
+    d.data = "\u934F" + d.data;
+  }, 100)
+}
+</script>