selection-pseudo-resource-invalidation-crash.html

<!DOCTYPE html>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<script src="../../resources/run-after-layout-and-paint.js"></script>
<style>
::selection {
  page-break-before: right;
}
</style>
<script>
async_test(t => {
  window.onload = t.step_func(() => {
    document.body.offsetTop;
    document.getElementById("text1").setAttribute("filter", "url(#f)");
    document.execCommand("SelectAll", false);

    runAfterLayoutAndPaint(t.step_func(() => {
      document.vlinkColor = "#ff0000";
      requestAnimationFrame(t.step_func_done());
    }));
  });
}, "Don't crash.");
</script>
<svg id="svg1">
  <text>Text2</text>
</svg>
<svg>
  <text id="text1">Text</text>
</svg>
<svg>
  <filter id="f">
    <feImage xlink:href="#svg1"/>
  </filter>
</svg>

chromium/third_party/blink/web_tests/svg/text/selection-pseudo-resource-invalidation-crash.html