third_party/WebKit/LayoutTests/svg/text/textpath-reference-crash.html

   1 <!DOCTYPE html>
   2 <html>
   3     <!-- Test for wkbug.com/88144 - Crash in SVGDocumentExtensions::removeAllElementReferencesForTarget. -->
   4     <head>
   5         <script>
   6             if (window.testRunner)
   7                 testRunner.dumpAsText();
   8
   9             window.onload = function() {
  10                 svg0 = document.createElementNS('http://www.w3.org/2000/svg', 'svg');
  11                 svg0.setAttribute('id', 'svg0');
  12                 document.body.appendChild(svg0);
  13
  14                 document.body.appendChild(document.createTextNode('A'));
  15
  16                 svg1 = document.createElementNS('http://www.w3.org/2000/svg', 'svg');
  17                 svg1.setAttribute('id', 'svg1');
  18                 svg1.appendChild(document.createTextNode('A'));
  19                 document.body.appendChild(svg1);
  20
  21                 document.body.appendChild(document.createTextNode('A'));
  22
  23                 image = document.createElementNS('http://www.w3.org/2000/svg', 'image');
  24                 image.setAttribute('id', 'image');
  25                 svg0.appendChild(image);
  26
  27                 textPath = document.createElementNS('http://www.w3.org/2000/svg', 'textPath');
  28                 textPath.setAttributeNS('http://www.w3.org/1999/xlink', 'xlink:href', '#svg1');
  29                 textPath.setAttribute('id', 'textPath');
  30                 image.appendChild(textPath);
  31
  32                 use = document.createElementNS('http://www.w3.org/2000/svg', 'use');
  33                 use.setAttributeNS('http://www.w3.org/1999/xlink', 'xlink:href', '#image');
  34                 use.setAttribute('id', 'use');
  35                 svg0.appendChild(use);
  36
  37                 image.setAttributeNS('http://www.w3.org/1999/xlink', 'xlink:href', '#svg0');
  38                 document.designMode = 'on';
  39                 window.getSelection().setBaseAndExtent(svg1, 0, svg1, 0);
  40                 document.execCommand('ForwardDelete');
  41
  42                 document.body.offsetTop;
  43                 document.body.innerHTML = "PASS";
  44             }
  45         </script>
  46     </head>
  47     <body>
  48     </body>
  49 </html>