From 5f8de423f190bbb79a62f804151bc24824fa32d8 Mon Sep 17 00:00:00 2001
From: "Matt A. Tobin" <mattatobin@localhost.localdomain>
Date: Fri, 2 Feb 2018 04:16:08 -0500
Subject: Add m-esr52 at 52.6.0

---
 layout/svg/crashtests/359516-1.svg | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 layout/svg/crashtests/359516-1.svg

(limited to 'layout/svg/crashtests/359516-1.svg')

diff --git a/layout/svg/crashtests/359516-1.svg b/layout/svg/crashtests/359516-1.svg
new file mode 100644
index 000000000..c997eb3a8
--- /dev/null
+++ b/layout/svg/crashtests/359516-1.svg
@@ -0,0 +1,36 @@
+<svg xmlns="http://www.w3.org/2000/svg" 
+     xmlns:html="http://www.w3.org/1999/xhtml"
+     class="reftest-wait"
+     onload="setTimeout(doStuff, 30);">
+
+<html:script style="display: none;" type="text/javascript">
+
+function doStuff()
+{
+  var svg = document.documentElement;
+  var ellipse = document.getElementById("ellipse");
+  var filter = document.getElementById("filter");
+
+  document.addEventListener("DOMNodeRemoved", foopy, false);
+  filter.removeChild(filter.firstChild);
+  document.removeEventListener("DOMNodeRemoved", foopy, false);
+  
+  function foopy()
+  {
+    document.removeEventListener("DOMNodeRemoved", foopy, false);
+    svg.appendChild(filter);
+  }
+
+  // Needed for the crash, but not for the assertion.
+  svg.appendChild(ellipse);
+  
+  document.documentElement.removeAttribute("class");
+}
+
+</html:script>
+
+<ellipse id="ellipse" cx="200" cy="150" rx="70" ry="40" style="filter: url(#filter);"/>
+
+<filter id="filter"> </filter>
+
+</svg>
-- 
cgit v1.2.3