image-with-attr-change-after-delete-crash.html

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
  <body id="body">
    <svg id="svgRoot" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg">
      <image height="410" id="svgImage" width="503" x="0" y="0" xlink:href="resources/green-checker.png"/>
      <script>
        if (window.testRunner) {
          testRunner.dumpAsText();
          testRunner.waitUntilDone();
        }

        function forceGC() {
          if (window.GCController)
            GCController.collect();
          else
            gc();
        }

        svgImage = document.getElementById("svgImage");
        docElement = document.getElementById("svgRoot");
        newTextNode = document.createTextNode(" Test Passes");
        setTimeout("crash()", 0);

        function crash() {
          svgImage.attributes[5].value = "no-image";
          svgImage.parentNode.removeChild(svgImage);
          delete svgImage;
          forceGC();
          docElement.appendChild(newTextNode);
          if (window.testRunner) {
            document.getElementById("body").innerHTML = "Test Passes when there is no crash";
            testRunner.notifyDone();
          }
        }
      </script>
    </svg>
  </body>
</html>

chromium/third_party/blink/web_tests/svg/custom/image-with-attr-change-after-delete-crash.html