third_party/WebKit/LayoutTests/svg/custom/element-instance-held-by-js-crash.svg

   1 <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
   2     <script>
   3     <![CDATA[
   4     window.onload = function() {
   5         // Grab a reference to an SVGElementInstance native object. This reference will prevent the
   6         // object from deletion when the shadow DOM is removed due to a style change.
   7         instance = document.getElementById("use_elem").instanceRoot;
   8
   9         // Setting an attribute forces re-creation of the shadow DOM
  10         document.getElementById("circleID").setAttribute("cx", 30);
  11
  12         // The animate element tries to modify the element, which tries to update the
  13         // instances in the circle, which crashes if it holds a pointer to a non-existent element.
  14
  15         if (window.testRunner)
  16             testRunner.dumpAsText();
  17     }
  18     //]]>
  19     </script>
  20     <circle transform="translate(1)" id="circleID" fill="green" cy="15" cx="15" r="10" >
  21         <animate attributeName="cy" />
  22     </circle>
  23     <text id="resultText" y="20" x="50" >
  24       PASS - Null corresponding element dereference does not crash.
  25     </text>
  26     <use id="use_elem" xlink:href="#circleID" />
  27 </svg>