Test for bug 601699. a=dveditz for fix.

layout/reftests/svg/path-03.svg

@@ -0,0 +1,29 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/licenses/publicdomain/
+-->
+<svg xmlns="http://www.w3.org/2000/svg">
+
+  <title>Testcase for invalid path</title>
+
+  <!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=601699 -->
+
+  <marker id="marker" markerWidth="10" markerHeight="10">
+    <circle cx="5" cy="5" r="5"/>
+  </marker>
+
+  <rect width="100%" height="100%" fill="lime"/>
+
+  <path id="path" fill="red" marker-mid="url(#marker)"/>
+
+  <script><![CDATA[
+
+// Parser will throw out path without an initial moveto command, so we use
+// script to inject one and see what happens.
+
+var path = document.getElementById("path");
+var curve = path.createSVGPathSegCurvetoCubicAbs(0, 400, 400, 400, 400, 0);
+path.pathSegList.appendItem(curve);
+
+  ]]></script>
+</svg>

layout/reftests/svg/reftest.list

@@ -126,6 +126,7 @@ random-if(gtk2Widget) == objectBoundingBox-and-fePointLight-01.svg objectBoundin
 == polyline-points-invalid-01.svg pass.svg
 == path-01.svg path-01-ref.svg
 == path-02.svg pass.svg
+== path-03.svg pass.svg
 == pattern-invalid-01.svg pattern-invalid-01-ref.svg
 == pattern-live-01a.svg pattern-live-01-ref.svg
 == pattern-live-01b.svg pattern-live-01-ref.svg