chromium/third_party/blink/web_tests/external/wpt/mathml/crashtests/mozilla/1600635.html

<style>
  * {
    overflow-inline: scroll;
  }
</style>
<script>
  window.addEventListener('load', () => {
    const mbsubsup = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'msubsup')
    const m = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'm')
    const ms = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'ms')
    mbsubsup.appendChild(m)
    ms.innerHTML = '<figure>'
    mbsubsup.appendChild(ms)
    document.documentElement.appendChild(mbsubsup)
  })
</script>