chromium/third_party/blink/web_tests/svg/animations/animate-calcMode-spline-crash-bad-array-length.xhtml

<html xmlns="http://www.w3.org/1999/xhtml">
    <body>
        <svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
            <path
                d="m 65.912454,142.33657 c 32.971728,0.47546 54.353006,2.31459 71.732026,10.88083 17.37902,8.56625 34.29132,22.84947 51.25404,50.23341 13.77183,26.13619 16.30585,56.55141 24.4592,84.76493 10.69173,38.71495 20.90606,82.87651 67.29492,88.93182 41.52078,0.3788 52.41155,-41.57971 59.06828,-62.96039 6.46861,-20.7765 10.67334,-53.22798 17.38318,-74.37414 13.10483,-41.30006 19.81437,-45.96631 29.91229,-57.75202"
                id="path_a"
                style="fill:none;stroke:none;stroke-width:0.2;marker-mid:none;marker-end:none" />

                <circle id="mycircle" cx="0" cy="0" r="12" >
                    <animateMotion id="A" dur="2s" keyTimes="0; 0.6; 1"
                        calcMode="spline" keySplines="1 0 1 0;0 1 0 1;"
                        repeatCount="1" rotate="auto" fill="freeze">
                            <mpath xlink:href="#path_a" />
                    </animateMotion>
                </circle>
            </svg>
        <script>
            if (window.testRunner) {
                testRunner.dumpAsText();
                testRunner.waitUntilDone();
	    }
            setTimeout(function () {
                    document.body.innerHTML = "PASS, if DumpRenderTree doesn't crash, and no assertion in a Debug build.";
                    if (window.testRunner)
                        testRunner.notifyDone();
                }, 0);

        </script>
    </body>
</html>