chromium/third_party/blink/web_tests/svg/animations/remove-begin-event-crash.html

<!DOCTYPE HTML>
<html onload="mutate();">
Test that event listeners are correctly removed when eventBase conditions are cleared. This test passes if it does not crash.<br/>
PASS
<svg>
  <animate id="anim" attributeName="visibility" />
  <set begin="anim.beginEvent" id="set" to="100" attributeName="width" />
</svg>
<script>
  var set = document.getElementById("set");
  function mutate() {
    set.removeAttribute("begin");
    set.parentNode.removeChild(set);
    delete set;
  }
  if (window.testRunner)
    testRunner.dumpAsText();
</script>
</html>