chromium/third_party/blink/web_tests/svg/animations/animate-keysplines-crash.html

<!DOCTYPE HTML>
<html>
<body>
Test for crbug.com/276111: This test passes if it does not crash.
<svg xmlns="http://www.w3.org/2000/svg">
  <rect>
      <animateMotion path="M 1 2Z" id="animateMotionElement" calcMode="spline" values="M 1 2Z; M3 4Z"/>
  </rect>
</svg>
<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}

function removePathAndFinishTest() {
    animateMotionElement.removeAttribute('path');
    setTimeout(function() {
        document.write("PASS");
        if (window.testRunner)
            testRunner.notifyDone();
    }, 0);
}

setTimeout('removePathAndFinishTest()', 0);
</script>
</body>
</html>