third_party/WebKit/LayoutTests/fast/images/crash-bad-cast.html

   1 <!doctype HTML>
   2 <script>
   3 function start() {
   4     o4=document.documentElement;
   5     o22=document.body;
   6     o46=document.createElementNS('http://www.w3.org/1999/xhtml','iframe');
   7     o46.src="resources/test.svg";
   8     o46.onload=cb_nodesvgiframes_97_1;
   9     o4.appendChild(o46)
  10 }
  11 function cb_nodesvgiframes_97_1() {
  12     o59=o46.contentDocument.getElementById('svg0');
  13     o61=o46.contentDocument.getElementById('svg3');
  14     o61.innerHTML='<script><![CDATA[\r//]]><\/script>';
  15     o22.appendChild(o59);
  16     document.designMode='on';
  17     document.execCommand('selectall');
  18 }
  19 if (window.testRunner)
  20     testRunner.dumpAsText();
  21 </script>
  22 <body onload="start()">
  23 <!-- crbug.com/440836: Will crash if we have a bad cast to an Element node while iterating through text. -->
  24 </body>
  25
  26