Steps to reproduce: run-webkit-tests svg/as-object/svg-in-object-dynamic-attribute-change.html --no-retry --repeat 2 On the second try, image #4 fails to load. It is loaded like this: var object4 = document.getElementById("object4"); object4.onload = onObjectLoad; object4.setAttribute("type", "image/png"); object4.setAttribute("data", "resources/lime100x100.png"); This is 100% reproducible, and still happens when I remove other sub-tests from this test.
The test is currently marked as a flaky failure, so to reproduce, please add -v (verbose).