Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/fast/events/touch/touch-event-target-crash.html 

<!DOCTYPE html>
<html>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

var docElement = document.documentElement;
function crash() {
    svgAnimAttributeElement1 = document.createElementNS("http://www.w3.org/2000/svg", "animattributeattrs");
    svgAnimateElement1 = document.createElementNS("http://www.w3.org/2000/svg", "animate");
    svgTestcaseElement1 = document.createElementNS("http://www.w3.org/2000/svg", "svgtestcase");
    svgEllipseElement1 = document.createElementNS("http://www.w3.org/2000/svg", "ellipse");
    mathElement1 = document.createElementNS("http://www.w3.org/1998/Math/MathML", "math");
    docElement.appendChild(mathElement1);
    svgLineElement1 = document.createElementNS("http://www.w3.org/2000/svg", "line");
    textNode1 = document.createTextNode("mNfma;B N`p0ag     ");
    svgEllipseElement1.addEventListener("touchcancel", function () {}, false);
    document1 = document.implementation.createDocument("", null);
    svgAnimateElement1.appendChild(svgEllipseElement1);
    mathElement1.appendChild(svgAnimateElement1);
    document1.appendChild(svgLineElement1);
    svgLineElement1.appendChild(svgTestcaseElement1);
    svgTestcaseElement1.appendChild(svgAnimAttributeElement1);
    document2 = document.implementation.createDocument("http://www.w3.org/1999/xhtml", "html"); document2.adoptNode(textNode1);
    svgAnimAttributeElement1.appendChild(mathElement1);
    svgEllipseElement1.parentNode.removeChild(svgEllipseElement1);
    delete svgEllipseElement1;
    gc();
    document.open();
    document.write("Passed. Test didn't crash.");
    document.close();
}
document.addEventListener("DOMContentLoaded", crash, false);
</script>
</html>