dom/svg/crashtests/1402798.html

   1 <style>
   2     text::first-letter {}
   3 </style>
   4 <script>
   5     function js() {
   6         a.setAttribute("fill", "url()");
   7     }
   8 </script>
   9 <body onload=js()>
  10 <svg>
  11 <text id="a">aa</text>