third_party/WebKit/LayoutTests/svg/transforms/svg-matrix-tearoff-crash.html

   1 <!DOCTYPE html>
   2 <script>
   3 if (window.testRunner)
   4     testRunner.dumpAsText();
   5
   6 function eventhandler1() {
   7     var transformList = document.createElementNS("http://www.w3.org/2000/svg", "radialGradient").gradientTransform.baseVal;
   8     var transform = document.querySelector("svg").createSVGTransform();
   9     transformList.appendItem(transform);
  10     var matrix = transform.matrix;
  11     transformList.initialize(transform);
  12     matrix.flipX();
  13 }
  14 </script>
  15 This test passes if it doesn't crash under ASAN.
  16 <svg onload="eventhandler1()">