1 files changed, 30 insertions, 0 deletions
diff --git a/Source/WebCore/manual-tests/svg-crash-hovering-use.svg b/Source/WebCore/manual-tests/svg-crash-hovering-use.svg
new file mode 100644
index 0000000..029b23b
--- /dev/null
+++ b/Source/WebCore/manual-tests/svg-crash-hovering-use.svg
@@ -0,0 +1,30 @@
+<?xml version="1.0" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg id="svg" viewBox="0 0 100 30" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<defs>
+    <rect id="rect" width="60" height="10"/>
+</defs>
+
+<text x="30" y="30" transform="scale(0.2 0.2)">Hover over the rectangle - it should not crash</text>
+<use id="use" x="20" y="10" xlink:href="#rect" />
+
+<script>
+<![CDATA[
+    var svg = document.getElementById("svg");
+    var use = document.getElementById("use");
+
+    function addUseElement() {
+        svg.appendChild(use, true);
+        setTimeout(removeUseElement, 50);
+    }
+
+    function removeUseElement() {
+        use.parentElement.removeChild(use);
+        setTimeout(addUseElement, 50);
+    }
+
+    document.addEventListener("DOMNodeInserted", function() {}, true);
+    removeUseElement();
+]]>
+</script>
+</svg>