<!DOCTYPE html>
<html>
<head>
<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}
</script>
</head>
<body>
 <!-- This tests that we don't crash when overwriting the contents of page that has an SVG tree containing <use> elements
 with references (i.e. xlink:href). You must run this test in DRT with Guard Malloc/MallocScribble (or the platform-
 specific equivalent) enabled. -->
<svg>
    <defs>
        <g id="bg1">
            <use xlink:href="#fill-rgn"/>
        </g>
    </defs>
    <use id="A" xlink:href="#bg1"/>
    <text id="B" x="0" y="20">FAIL</text>
</svg>
<script>
// Synchronous write; mark <use id="A"> as needing to be rebuilt because <g id="bg1"> is removed from the document.
document.write("FAIL");
window.setTimeout(crash, 0);

function crash() {
    document.designMode = "on";
    document.execCommand("SelectAll");
    document.execCommand("FontName", true, "H5"); // Rebuilds targets for SVG nodes.

    // Remove the contents between <use id="A"> and <text id="B"> (inclusively). Notice that these nodes have already been
    // removed by the synchronous document.write() call above.
    var range = document.createRange();
    range.setStartBefore(document.getElementById("A"));
    range.setEndAfter(document.getElementById("B"));
    range.deleteContents(); // Rebuilds targets for SVG nodes.

    if (window.GCController)
        GCController.collect();

    // Crash; rebuilds targets for SVG nodes, including the "element" at the memory location formerly occupied by <use id="A">.
    document.body.innerHTML = "PASS, did not crash";

    if (window.testRunner)
        testRunner.notifyDone();
}
</script>
</body>
</html>