dom/svg/crashtests/1572904.html

   1 <script>
   2 function go() {
   3   a.addEventListener("DOMSubtreeModified", go)
   4   b.setAttribute("y", "")
   5   SpecialPowers.gc()
   6   SpecialPowers.forceCC()
   7   try { c.viewBox.animVal[undefined] = ''} catch(e) { }
   8   try { c.viewBox.animVal.x; } catch(e) { }
   9 }
  10 </script>
  11 <filter id="a">
  12 <svg id="" onload="go()">
  13 <path id="b">
  14 <view id="c" viewBox="1 9 0 1" />
  15