<!DOCTYPE html>
<html>
<body>
<!-- Test for https://bugs.webkit.org/show_bug.cgi?id=88547 -->
<svg xmlns="http://www.w3.org/2000/svg">
  <foreignObject>
    <div id="div" style="position:fixed; height:50%; counter-increment:inherit;">Passes if replacing this text doesn't cause a crash.</div>
  </foreignObject>

  <script>
    window.onload=function() {
      document.designMode="on";
      document.execCommand("SelectAll");
      document.getElementById('div').innerHTML = "PASS";
    };

    if (window.testRunner)
      testRunner.dumpAsText();
  </script>
</svg>
</body>
</html>