mpath-remove-from-dependents-on-delete-crash.html

<html xmlns="http://www.w3.org/1999/xhtml">
  <body>
    <svg id="svgRoot" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
      <path id="path_a" />
      <circle id="myc">
        <animateMotion id="A" >
          <mpath xlink:href="#path_a" />
        </animateMotion>
      </circle>
    </svg>

    <script type="text/javascript">
      if (window.testRunner) {
          testRunner.waitUntilDone();
      }
      onload = function() {
        if (location.hash != '#5') {
          if (window.GCController)
            window.GCController.collect();
          else if (window.gc)
            gc();
          document.getElementById("A").insertBefore(document.getElementById("path_a"), null);
          if (location.hash == '')
            location.hash = '#1';
          else
            location.hash = "#" + (parseInt(location.hash.slice(1)) + 1).toString();
          setTimeout(function(){ location.reload() }, 0);
        } else {
          document.body.innerText = 'PASS: WebKit did not crash.';
          if (window.testRunner)
            testRunner.notifyDone();
        }
      }
    </script>

  </body>
</html>

chromium/third_party/blink/web_tests/svg/animations/mpath-remove-from-dependents-on-delete-crash.html