Index: LayoutTests/svg/custom/unicode-in-tspan-multi-svg-crash.html |
diff --git a/LayoutTests/svg/custom/unicode-in-tspan-multi-svg-crash.html b/LayoutTests/svg/custom/unicode-in-tspan-multi-svg-crash.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..19b43017b50554a6e03a4f3f12ae646a6b86bef1 |
--- /dev/null |
+++ b/LayoutTests/svg/custom/unicode-in-tspan-multi-svg-crash.html |
@@ -0,0 +1,38 @@ |
+<!DOCTYPE html> |
+<html> |
+ <script> |
+ if (window.testRunner) |
+ testRunner.dumpAsText(false); |
+ |
+ onload = function() { |
+ tSpanElement = document.getElementById('tSpanInFirstRoot'); |
+ tSpanElement.appendChild(document.createTextNode(unescape('%ufe9e%ue28f%ue47e'))); |
+ |
+ document.body.offsetTop; |
+ document.body.style.zoom=0.9; |
+ |
+ document.designMode='on'; |
+ filterInFirstRoot = document.getElementById('filterInFirstRoot'); |
+ useElement = document.getElementById('useElement'); |
+ window.getSelection().setBaseAndExtent(filterInFirstRoot, useElement, 5); |
+ document.execCommand('ForwardDelete'); |
+ document.designMode='off'; |
+ } |
+ </script> |
+ <body> |
+ <svg xmlns="http://www.w3.org/2000/svg"> |
+ <text> |
+ <filter id="filterInFirstRoot"/> |
+ <tspan id="tSpanInFirstRoot"/> |
+ </text> |
+ <path filter="url(#filterInSecondRoot)"/> |
+ </svg> |
+ |
+ <svg xmlns="http://www.w3.org/2000/svg"> |
+ <use id="useElement"/> |
+ <filter id="filterInSecondRoot"/> |
+ </svg> |
+ |
+ <p>Test Passes if there is no crash in Debug or Asan builds. There should be no characters preceding "Test".</p> |
+ </body> |
+</html> |