chromium/third_party/blink/web_tests/svg/custom/font-platformDestroy-crash.svg

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1 Tiny//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11-tiny.dtd">

<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" id="svg-root" width="100%" height="100%" viewBox="0 0 480 360">
    <style id="style">
        text { }
    </style>
    <g id="test-body-content" font-size="10">
        <defs>
        <font id="embeded" horiz-adv-x="224">
<font-face font-family="embeded" units-per-em="1000" panose-1="0 0 0 0 0 0 0 0 0 0" ascent="917" descent="-250" alphabetic="0"/>
            <glyph unicode="1" glyph-name="gl_1" horiz-adv-x="1500" d="M 0 0 L 250 0 L 250 250 L 0 250 Z"/>
        </font>
        </defs>

        <g transform="translate(100, 40)">
            <text font-family="embeded">1</text>
        </g>
        <g transform="translate(100, 60)">
            <text>Test for http://bugs.webkit.org/show_bug.cgi?id=16967</text>
        </g>
    </g>

    <script><![CDATA[
        if (window.testRunner)
            testRunner.dumpAsText();

        var style = document.getElementById("style");
        var parent = style.parentNode;

        for (var t = 0; t < 50; t++) {
            parent.clientTop;
            parent.removeChild(style);
            parent.appendChild(style);
        }
    ]]></script>
</svg>