summaryrefslogtreecommitdiffstats
path: root/third_party/WebKit/LayoutTests/fast/images/crash-bad-cast.html
blob: f6349b81ed3e6939c495495dd34541a58696981b (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
<!doctype HTML>
<script>
function start() {
    o4=document.documentElement;
    o22=document.body;
    o46=document.createElementNS('http://www.w3.org/1999/xhtml','iframe');
    o46.src="resources/test.svg"; 
    o46.onload=cb_nodesvgiframes_97_1;
    o4.appendChild(o46)
}
function cb_nodesvgiframes_97_1() {
    o59=o46.contentDocument.getElementById('svg0');
    o61=o46.contentDocument.getElementById('svg3');
    o61.innerHTML='<script><![CDATA[\r//]]><\/script>';
    o22.appendChild(o59);
    document.designMode='on';
    document.execCommand('selectall');
}
if (window.testRunner)
    testRunner.dumpAsText();
</script>
<body onload="start()">
<!-- crbug.com/440836: Will crash if we have a bad cast to an Element node while iterating through text. -->
</body>