<svg xmlns="http://www.w3.org/2000/svg" onload="load()">
This test passes if it doesn't crash when run under gmalloc.
<rect x="10" y="10" width="100" height="100" fill="green"/>
<text x="50" y="50" id="log"/>
<script>
<![CDATA[
function log(message) {
    var logDiv = document.getElementById('log');
    logDiv.appendChild(document.createTextNode(message));
}

function load() {
    if (window.testRunner && window.GCController && window.internals)
        testRunner.dumpAsText();
    else {
        log("This test only works when run with the testRunner, GCController, and internals available.");
        return;
    }

    var rect = document.getElementsByTagName("rect")[0];
    var baseValReference = rect.x.baseVal;
    
    // Collect garbage before recording starting live node count, in case there are live elements from previous tests.
    GCController.collect();
    var originalLiveElements = window.internals.numberOfLiveNodes();

    rect.parentNode.removeChild(rect);
    rect = 0;
    
    GCController.collect();
    
    // The rest of this test should FAIL without requiring gmalloc if this test has regressed.
    var liveDelta = window.internals.numberOfLiveNodes() - originalLiveElements;
    
    // Make sure that the <rect> is deleted; if it's not, liveDelta will be 0.
    if (liveDelta == -1)
        log(" PASS");
    else
        log(" FAIL: " + liveDelta + " extra live node(s)");
        
    // This line will crash with gmalloc if this test has regressed.
    log(" x = " + baseValReference.value);
}
]]>
</script>
</svg>