1 files changed, 25 insertions, 0 deletions
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/243159-2.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/243159-2.xhtml
new file mode 100644
index 0000000000..ff0326816d
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/243159-2.xhtml
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:mathml="http://www.w3.org/1998/Math/MathML">
+      <body onload="run()">
+      <mathml:math id="test" style="display: block">
+      </mathml:math>
+<script>
+  function run() {
+    var t1 = document.createElementNS("http://www.w3.org/1998/Math/MathML",
+                                      "mtable");
+    var t2 = document.createElementNS("http://www.w3.org/1998/Math/MathML",
+                                      "mtable");
+    var r1 = document.createElementNS("http://www.w3.org/1998/Math/MathML",
+                                      "mtr");
+    var r2 = document.createElementNS("http://www.w3.org/1998/Math/MathML",
+                                      "mtr");
+    var test =
+      document.getElementsByTagNameNS("http://www.w3.org/1998/Math/MathML", "math")[0];
+    t1.appendChild(r1);
+    test.appendChild(t1);
+    test.appendChild(t2);
+    t2.appendChild(r2);
+  }
+</script>
+</body>
+</html>