simple-duration-mutation-crash.html

<!DOCTYPE html>
<script src="../../resources/run-after-layout-and-paint.js"></script>
<svg>
  <animateTransform id="a" attributeName="transform" values="1 2; 3 4; 5 6"/>
</svg>
<p>PASS if no crash</p>
<script>
if (window.testRunner) {
  testRunner.dumpAsText();
  testRunner.waitUntilDone();
}
onload = function() {
  setTimeout(function() {
    var element = document.getElementById("a");
    element.setAttribute("dur", "0.1s");
    element.setAttribute("end", "NotARealEvent");

    runAfterLayoutAndPaint(function() {}, true);
  });
};
</script>

chromium/third_party/blink/web_tests/svg/animations/simple-duration-mutation-crash.html