crossfade-client-not-removed-crash.html

<!DOCTYPE html>
<html>
<body id=tCF1>
A
<style>
.class1 {
    background-image: -webkit-cross-fade(url(#does-not-exist), url(http://-4294967295), 157%);
}
.class2:first-of-type {
    -webkit-animation-direction: alternate;
}
</style>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

var docElement = document.body;
docElement.contentEditable = "true";

function crash() {
    test1 = document.createElementNS("http://www.w3.org/1999/xhtml", "thead");
    docElement.appendChild(test1);
    test2 = document.createElementNS("http://www.w3.org/1999/xhtml", "intent");
    test2.setAttribute("class", "class2");
    docElement.appendChild(test2);
    test1.setAttribute("class", "class1");
    window.getSelection().selectAllChildren(tCF1);
    document.execCommand("hilitecolor", false, "#FF0000");
    document.execCommand("InsertText", false, "PASS. WebKit didn't crash.");
}

document.addEventListener("DOMContentLoaded", crash, false);
</script>
</html>

chromium/third_party/blink/web_tests/images/crossfade-client-not-removed-crash.html