selection-style-within-mask-crash.html

<!DOCTYPE html>
<style>
text::selection { color: blue; }
</style>
<script>
if (window.testRunner)
  testRunner.dumpAsText();

window.onload = function () {
  var range = document.createRange();
  range.setEnd(id1, id1.childNodes.length);
  document.getSelection().addRange(range);
  document.getElementById("masktext").setAttribute("display", "inherit");
};
</script>
<svg>
  <mask id="m1">
    <text id="masktext" y="100" fill="white" font-size="100">PASS</text>
  </mask>
  <rect width="100%" height="100" id="id1" mask="url(#m1)"/>
</svg>

chromium/third_party/blink/web_tests/svg/text/selection-style-within-mask-crash.html