<!DOCTYPE html>
<html>
<body>
<!-- Test for https://bugs.webkit.org/show_bug.cgi?id=88547 -->
<svg xmlns="http://www.w3.org/2000/svg">
<foreignObject>
<div id="div" style="position:fixed; height:50%; counter-increment:inherit;">Passes if replacing this text doesn't cause a crash.</div>
</foreignObject>
<script>
window.onload=function() {
document.designMode="on";
document.execCommand("SelectAll");
document.getElementById('div').innerHTML = "PASS";
};
if (window.testRunner)
testRunner.dumpAsText();
</script>
</svg>
</body>
</html>