chromium/third_party/blink/web_tests/external/wpt/mathml/crashtests/mozilla/364685-1.xhtml

<html xmlns="http://www.w3.org/1999/xhtml"
      xmlns:math="http://www.w3.org/1998/Math/MathML">

<body onload="boom();">

<script>
function boom()
{
  document.getElementById("merror").appendChild(document.getElementById("s"));
}
</script>

<math:merror id="merror"></math:merror>

<span id="s" />

</body>
</html>