image-set-value-not-removed-crash.html

<!DOCTYPE html>
<html>
A
<style>
@-webkit-keyframes anim1 {
    0% { 
        opacity: 0.5772; border-image: 26829%;
    } 
    100% {
        opacity: 0.3167;
    }
}
* { 
    -webkit-animation-name: anim1;
    -webkit-animation-duration: 1s;
}
.class1 {
    border-image: -webkit-image-set(url(#does-not-exist) 25x, url("does-not-exist.gif") 206x) 2 126 158 166 fill;
    border-image: image-set(url(#does-not-exist) 25x, url("does-not-exist.gif") 206x) 2 126 158 166 fill;
}
</style>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

var docElement = document.body;
docElement.contentEditable = "true";

function crash() {
    test1 = document.createElementNS("http://www.w3.org/1999/xhtml", "td");
    test1.setAttribute("class", "class1");
    docElement.appendChild(test1);
    document.execCommand("SelectAll", false, null)
    document.execCommand("InsertText", false, "PASS. WebKit did not crash.")
    for (i = 0; i != 49; i++)
         window.getSelection().modify("move", "forward", "character");

    document.execCommand("Italic", false, null);
}
document.addEventListener("DOMContentLoaded", crash, false);
</script>
</html>
chromium/third_party/blink/web_tests/fast/css/image-set-value-not-removed-crash.html
