chromium/third_party/blink/web_tests/svg/css/crash-css-generated-content.xhtml

<!DOCTYPE html
  PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html lang="en-US" xml:lang="en-US" xmlns="http://www.w3.org/1999/xhtml">
    <style>
        svg text:before {
            content: 'FAIL';
        }
        svg text:after {
            content: 'FAIL';
        }
    </style>
    <head>
        <title>Test case for rdar://6302405</title>
    </head>
    <body>
        <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
            <text x="50" y="50">This test ensures that we do not crash when css generated content attempts to attach to svg text</text>
        </svg>
        <script>
        <![CDATA[
            if (window.testRunner)
                testRunner.dumpAsText();
        ]]>
        </script>
    </body>
</html>