| <!DOCTYPE html> |
| <html> |
| <script> |
| if (window.testRunner) |
| testRunner.dumpAsText(); |
| |
| var docElement = document.documentElement; |
| function crash() { |
| svgAnimAttributeElement1 = document.createElementNS("http://www.w3.org/2000/svg", "animattributeattrs"); |
| svgAnimateElement1 = document.createElementNS("http://www.w3.org/2000/svg", "animate"); |
| svgTestcaseElement1 = document.createElementNS("http://www.w3.org/2000/svg", "svgtestcase"); |
| svgEllipseElement1 = document.createElementNS("http://www.w3.org/2000/svg", "ellipse"); |
| mathElement1 = document.createElementNS("http://www.w3.org/1998/Math/MathML", "math"); |
| docElement.appendChild(mathElement1); |
| svgLineElement1 = document.createElementNS("http://www.w3.org/2000/svg", "line"); |
| textNode1 = document.createTextNode("mNfma;B N`p0ag "); |
| svgEllipseElement1.addEventListener("touchcancel", function () {}, false); |
| document1 = document.implementation.createDocument("", null); |
| svgAnimateElement1.appendChild(svgEllipseElement1); |
| mathElement1.appendChild(svgAnimateElement1); |
| document1.appendChild(svgLineElement1); |
| svgLineElement1.appendChild(svgTestcaseElement1); |
| svgTestcaseElement1.appendChild(svgAnimAttributeElement1); |
| document2 = document.implementation.createDocument("http://www.w3.org/1999/xhtml", "html"); document2.adoptNode(textNode1); |
| svgAnimAttributeElement1.appendChild(mathElement1); |
| svgEllipseElement1.parentNode.removeChild(svgEllipseElement1); |
| delete svgEllipseElement1; |
| gc(); |
| document.open(); |
| document.write("Passed. Test didn't crash."); |
| document.close(); |
| } |
| document.addEventListener("DOMContentLoaded", crash, false); |
| </script> |
| </html> |
