michael@0: <svg xmlns="http://www.w3.org/2000/svg" 
michael@0:      xmlns:html="http://www.w3.org/1999/xhtml"
michael@0:      class="reftest-wait"
michael@0:      onload="setTimeout(doStuff, 30);">
michael@0: 
michael@0: <html:script style="display: none;" type="text/javascript">
michael@0: 
michael@0: function doStuff()
michael@0: {
michael@0:   var svg = document.documentElement;
michael@0:   var ellipse = document.getElementById("ellipse");
michael@0:   var filter = document.getElementById("filter");
michael@0: 
michael@0:   document.addEventListener("DOMNodeRemoved", foopy, false);
michael@0:   filter.removeChild(filter.firstChild);
michael@0:   document.removeEventListener("DOMNodeRemoved", foopy, false);
michael@0:   
michael@0:   function foopy()
michael@0:   {
michael@0:     document.removeEventListener("DOMNodeRemoved", foopy, false);
michael@0:     svg.appendChild(filter);
michael@0:   }
michael@0: 
michael@0:   // Needed for the crash, but not for the assertion.
michael@0:   svg.appendChild(ellipse);
michael@0:   
michael@0:   document.documentElement.removeAttribute("class");
michael@0: }
michael@0: 
michael@0: </html:script>
michael@0: 
michael@0: <ellipse id="ellipse" cx="200" cy="150" rx="70" ry="40" style="filter: url(#filter);"/>
michael@0: 
michael@0: <filter id="filter"> </filter>
michael@0: 
michael@0: </svg>