chromium/third_party/blink/web_tests/fast/parser/fragment-foreign-content-misnested.html

<script>
    if (window.testRunner)
        testRunner.dumpAsText();
        
    function test()
    {
        document.body.innerHTML += "<svg><br>";
    }
</script>
<body onload="test()">
Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=55982">https://bugs.webkit.org/show_bug.cgi?id=55982</a>. Verify that WebKit does not ASSERT when an invalid start tag is encountered while the parser's insertion mode is InForeignContentMode.