chromium/third_party/blink/web_tests/svg/animations/animate-element-reinserted-crash.html

<!doctype html>
<div>
  <svg width="200" height="200">
    <rect width="20" height="20" x="10" y="10">
      <animate attributeName="fill" values="#111; #111" dur="2s" repeatCount="indefinite"/>
    </rect>
  </svg>
</div>
<script type="text/javascript">
function pass() {
    document.write("PASS");
    if (window.testRunner)
        testRunner.notifyDone();
}
window.onload = function() {
    if (window.testRunner) {
        testRunner.waitUntilDone();
        testRunner.dumpAsText();
    }
    window.setTimeout(function() {
        var f = document.createDocumentFragment();
        var n = document.querySelector('div');
        while (n.lastChild) {
            f.appendChild(n.lastChild);
        }
        n.appendChild(f);
        window.setTimeout(pass, 0);
    }, 20);
};
</script>