chromium/third_party/blink/web_tests/svg/dom/vkern-element-crash.html

<html>
<head>
<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}

gc = window.gc || function()
{
    if (window.GCController)
        return GCController.collect();
        
    for (var i = 0; i < 10000; ++i)
        var s = new String("AAAA");
}

window.onload = function()
{   
    element1 = document.body.appendChild(document.createElement('x'));
    element1.id = "foo";
    
    parent = document.createElementNS("http://www.w3.org/2000/svg", "vkern");
    element2 = parent.appendChild(document.createElement('x'));
    element2.id = "foo";
    document.body.appendChild(parent);
    
    element3 = document.body.appendChild(document.createElement('x'));
    element3.id = "foo";
    
    document.body.removeChild(element1);
    document.getElementById("foo");
    
    parent.removeChild(element2);
    element2 = null;
    gc();
    
    setTimeout(finishTest, 0);
}

function finishTest()
{
    document.getElementById("foo");
    
    if (window.testRunner)
        testRunner.notifyDone();
}
</script>
</head>
<body>PASS</body>
</html>