chromium/src/third_party/blink/web_tests/svg/custom/tref-nested-events-crash.svg

<?xml version="1.0" encoding="UTF-8"?>
<svg onload="CFcrash()" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
  <!-- Test for https://bugs.webkit.org/show_bug.cgi?id=93004 -->
  <g id="test-body-content">
    <defs>
        <text id="hello">
            <tspan id="tspan">##</tspan>
        </text>
    </defs>

    <text>
        <tref id="tref" xlink:href="#hello"></tref>
    </text>
  </g>

  <text>PASS: did not crash.</text>
  <script>
    if (window.testRunner) {
        testRunner.waitUntilDone();
        testRunner.dumpAsText();
    }

    var test_body_content = document.getElementById("test-body-content");
    var tspan = document.getElementById("tspan");

    function CFcrash() {
        test_body_content.addEventListener("DOMCharacterDataModified", function () { 
            try { test_body_content.parentNode.removeChild(test_body_content); } catch (e) {}

            if (window.testRunner)
                setTimeout('testRunner.notifyDone()', 0);
        }, false); 
        document.adoptNode(tspan); 
        if (window.testRunner)
            setTimeout('testRunner.notifyDone()', 10);
    }
  </script>
</svg>