<!DOCTYPE html>
<!-- This test is to catch a flakey use-after-free for ASAN bots. (see crbug.com/402407) -->
<script>
  function start() {
    svgIframe = document.createElement('iframe');
    svgIframe.src = 'resources/do-not-crash-use-after-free-update-widget-positions.svg';

    bodyElement = document.body;

    articleElement = document.createElement('article');
    acronymElement = document.createElement('acronym');

    bodyElement.style.overflow = 'scroll';

    selectionRange = document.createRange();
    selectionRange.selectNodeContents(articleElement);
    selectionRange.surroundContents(bodyElement);

    w3Iframe = document.createElementNS('http://www.w3.org/1999/xhtml', 'iframe');
    w3Iframe.src = 'resources/do-not-crash-use-after-free-update-widget-positions-iframe.html';
    w3Iframe.onload = iframeOnLoad;
    document.documentElement.appendChild(w3Iframe);

    selectionRange.insertNode(svgIframe);
    bodyElement.style.position = 'fixed';

    while (svgIframe.parentNode) {
      svgIframe = svgIframe.parentNode;
    }

    svgIframe.createElement;

    document.documentElement.appendChild(svgIframe);

    acronymElement.style.position = 'absolute';
  }

  function iframeOnLoad() {
    w3Iframe.onload = undefined;

    bodyElement.appendChild(acronymElement);
    acronymElement.offsetWidth;

    acronymElement.appendChild(w3Iframe);
    w3Iframe.offsetWidth;

    window.setTimeout('window.iframeCallback()', 50);
  }

  function iframeCallback() {
    bodyElement.style.cssText = null;

    w3Iframe.contentDocument.location.hash = 'element0';
  }

  if (window.testRunner) {
    testRunner.dumpAsText();
  }
</script>
<body onload = "start()">
  This test passes if it doesn't crash.
</body>