chromium/third_party/blink/web_tests/fast/ruby/ruby-svg-crash.html

This succeeds if this test doesn't crash.
<ruby id=rubyEl><dl></dl><rt id=rubyTextEl></rt>><script>
var docElement = document.body ? document.body : document.documentElement;
function initCF() {
try { fontFaceNameEl = document.createElementNS("http://www.w3.org/2000/svg", "font-face-name"); } catch(e) {}
try { clipPathEl = document.createElementNS("http://www.w3.org/2000/svg", "clipPath"); } catch(e) {}
setTimeout("CFcrash()", 0);
}
document.addEventListener("DOMContentLoaded", initCF, false);
function CFcrash() {
try { if (rubyTextEl != docElement) { rubyTextEl.parentNode.removeChild(rubyTextEl); }} catch(e) {}
try { clipPathEl.scrollIntoView(true); } catch(e) {}
try { fontFaceNameEl.appendChild(rubyEl); } catch(e) {}
}
function runTest()
{
    if (window.testRunner)
        testRunner.notifyDone();
}

if (window.testRunner) {
    testRunner.waitUntilDone();
}

setTimeout("runTest()", 10);
</script>