<!DOCTYPE html>
<html>
  <script>
    if (window.testRunner)
      testRunner.dumpAsText(false);

    onload = function() {
      tSpanElement = document.getElementById('tSpanInFirstRoot');
      tSpanElement.appendChild(document.createTextNode(unescape('%ufe9e%ue28f%ue47e')));

      document.body.offsetTop;
      document.body.style.zoom=0.9;

      document.designMode='on';
      filterInFirstRoot = document.getElementById('filterInFirstRoot');
      useElement = document.getElementById('useElement');
      window.getSelection().setBaseAndExtent(filterInFirstRoot, 0, filterInFirstRoot, 0);
      document.execCommand('ForwardDelete');
      document.designMode='off';
    }
  </script>
  <body>
    <svg xmlns="http://www.w3.org/2000/svg">
      <text>
        <filter id="filterInFirstRoot"/>
        <tspan id="tSpanInFirstRoot"/>
      </text>
      <path filter="url(#filterInSecondRoot)"/>
    </svg>

    <svg xmlns="http://www.w3.org/2000/svg">
      <use id="useElement"/>
      <filter id="filterInSecondRoot"/>
    </svg>

    <p>Test Passes if there is no crash in Debug or Asan builds.</p>
  </body>
</html>
