chromium/third_party/blink/web_tests/fast/parser/changing-attrbutes-crash.html

<svg><polygon class="bar" points="foo"></svg>
<script>
if (window.testRunner)
    testRunner.dumpAsText();
</script>
<p>This test passes if it doesn't crash.</p>