text-layout-crash.html | Explore in Territory

<!DOCTYPE html>
<html>
<meta charset="utf-8">
<body>
<script>
  onload = function() {
    document.body.offsetTop;
    document.body.style.zoom=0.9;

    document.designMode='on';
    window.getSelection().setBaseAndExtent(filterInFirstRoot, 0, null, 0);
    document.execCommand('ForwardDelete');
  }
</script>
This test passes if it does not crash.<br/>
<svg id="111">
  <text direction="rtl" id="filterInFirstRoot">
    <tspan id="tSpanInFirstRoot">abc</tspan>
  </text>
  <path filter="url(#filterInSecondRoot)"></path>
</svg>
<svg id="222">
  <filter id="filterInSecondRoot"></filter>
</svg>
</body>
</html>

chromium/third_party/blink/web_tests/svg/text/text-layout-crash.html