layout/svg/crashtests/464374-1.svg

   1 <svg xmlns="http://www.w3.org/2000/svg" onload="boom();">
   2
   3 <script type="text/javascript">
   4
   5 function boom()
   6 {
   7   document.getElementById("b").appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", "math"));
   8   document.getElementById("defs").setAttribute("filter", "url(#a)");
   9 }
  10
  11 </script>
  12
  13 <defs id="defs"><filter id="a"/><g id="b"><rect/></g></defs>
  14
  15 </svg>