crash-bad-cast.html | Explore in Territory

<!doctype HTML>
<script>
function start() {
    o4=document.documentElement;
    o22=document.body;
    o46=document.createElementNS('http://www.w3.org/1999/xhtml','iframe');
    o46.src="resources/test.svg"; 
    o46.onload=cb_nodesvgiframes_97_1;
    o4.appendChild(o46)
}
function cb_nodesvgiframes_97_1() {
    o59=o46.contentDocument.getElementById('svg0');
    o61=o46.contentDocument.getElementById('svg3');
    o61.innerHTML='<script><![CDATA[\r//]]><\/script>';
    o22.appendChild(o59);
    document.designMode='on';
    document.execCommand('selectall');
}
if (window.testRunner)
    testRunner.dumpAsText();
</script>
<body onload="start()">
<!-- crbug.com/440836: Will crash if we have a bad cast to an Element node while iterating through text. -->
</body>

chromium/third_party/blink/web_tests/images/crash-bad-cast.html