LayoutTests/fast/images/crossfade-client-not-removed-crash.html - WebKit - Git at Google

 <!DOCTYPE html>
 <html>
 <body id=tCF1>
 A
 <style>
 .class1 {
     background-image: -webkit-cross-fade(url(#does-not-exist), url(http://-4294967295), 157%);
 }
 .class2:first-of-type {
     -webkit-animation-direction: alternate;
 }
 </style>
 <script>
 if (window.testRunner)
     testRunner.dumpAsText();

 var docElement = document.body;
 docElement.contentEditable = "true";

 function crash() {
     test1 = document.createElementNS("http://www.w3.org/1999/xhtml", "thead");
     docElement.appendChild(test1);
     test2 = document.createElementNS("http://www.w3.org/1999/xhtml", "intent");
     test2.setAttribute("class", "class2");
     docElement.appendChild(test2);
     test1.setAttribute("class", "class1");
     window.getSelection().selectAllChildren(tCF1);
     document.execCommand("hilitecolor", false, "#FF0000");
     document.execCommand("InsertText", false, "PASS. WebKit didn't crash.");
 }

 document.addEventListener("DOMContentLoaded", crash, false);
 </script>
 </html>
	<!DOCTYPE html>
	<html>
	<body id=tCF1>
	A
	<style>
	.class1 {
	background-image: -webkit-cross-fade(url(#does-not-exist), url(http://-4294967295), 157%);
	}
	.class2:first-of-type {
	-webkit-animation-direction: alternate;
	}
	</style>
	<script>
	if (window.testRunner)
	testRunner.dumpAsText();

	var docElement = document.body;
	docElement.contentEditable = "true";

	function crash() {
	test1 = document.createElementNS("http://www.w3.org/1999/xhtml", "thead");
	docElement.appendChild(test1);
	test2 = document.createElementNS("http://www.w3.org/1999/xhtml", "intent");
	test2.setAttribute("class", "class2");
	docElement.appendChild(test2);
	test1.setAttribute("class", "class1");
	window.getSelection().selectAllChildren(tCF1);
	document.execCommand("hilitecolor", false, "#FF0000");
	document.execCommand("InsertText", false, "PASS. WebKit didn't crash.");
	}

	document.addEventListener("DOMContentLoaded", crash, false);
	</script>
	</html>