blink-in-js-asan-crash.html | Explore in Territory

<!DOCTYPE html>
<html>
<head>
<script>
    function runTest() {
        if (window.testRunner)
            testRunner.dumpAsText();

        if (sessionStorage.pageReloaded)
            return;

        img = document.createElement('img');
        img.src = `data:image/svg+xml,
            <svg xmlns="http://www.w3.org/2000/svg">
                <foreignObject>
                    <body xmlns="http://www.w3.org/1999/xhtml">
                        <marquee></marquee>
                    </body>
                </foreignObject>
            </svg>`;
        document.body.appendChild(img);

        sessionStorage.pageReloaded = true;
        window.location.reload();
    }
</script>
</head>
<body onload='runTest()'>
Test passes if it does not crash on ASan builds.
</body>
</html>

chromium/third_party/blink/web_tests/bindings/blink-in-js-asan-crash.html