LayoutTests/svg/dom/vkern-element-crash.html - WebKit - Git at Google

 <html>
 <head>
 <script>
 if (window.testRunner) {
     testRunner.dumpAsText();
     testRunner.waitUntilDone();
 }

 gc = window.gc || function()
 {
     if (window.GCController)
         return GCController.collect();

     for (var i = 0; i < 10000; ++i)
         var s = new String("AAAA");
 }

 window.onload = function()
 {
     element1 = document.body.appendChild(document.createElement(undefined));
     element1.id = "foo";

     parent = document.createElementNS("http://www.w3.org/2000/svg", "vkern");
     element2 = parent.appendChild(document.createElement(undefined));
     element2.id = "foo";
     document.body.appendChild(parent);

     element3 = document.body.appendChild(document.createElement(undefined));
     element3.id = "foo";

     document.body.removeChild(element1);
     document.getElementById("foo");

     parent.removeChild(element2);
     element2 = null;
     gc();

     setTimeout(finishTest, 0);
 }

 function finishTest()
 {
     document.getElementById("foo");

     if (window.testRunner)
         testRunner.notifyDone();
 }
 </script>
 </head>
 <body>PASS</body>
 </html>
	<html>
	<head>
	<script>
	if (window.testRunner) {
	testRunner.dumpAsText();
	testRunner.waitUntilDone();
	}

	gc = window.gc \|\| function()
	{
	if (window.GCController)
	return GCController.collect();

	for (var i = 0; i < 10000; ++i)
	var s = new String("AAAA");
	}

	window.onload = function()
	{
	element1 = document.body.appendChild(document.createElement(undefined));
	element1.id = "foo";

	parent = document.createElementNS("http://www.w3.org/2000/svg", "vkern");
	element2 = parent.appendChild(document.createElement(undefined));
	element2.id = "foo";
	document.body.appendChild(parent);

	element3 = document.body.appendChild(document.createElement(undefined));
	element3.id = "foo";

	document.body.removeChild(element1);
	document.getElementById("foo");

	parent.removeChild(element2);
	element2 = null;
	gc();

	setTimeout(finishTest, 0);
	}

	function finishTest()
	{
	document.getElementById("foo");

	if (window.testRunner)
	testRunner.notifyDone();
	}
	</script>
	</head>
	<body>PASS</body>
	</html>