chromium/third_party/blink/web_tests/svg/animations/smil-element-not-removed-crash.html

<html>
    <body onload="runSMILTest()">
        <svg>
            <animAttributeAttrs>
                <feImage id="test"></feImage>
            </animAttributeAttrs>
            <set id="set1" xlink:href="#test"></set>
        </svg>
        <script>
            if (window.testRunner) {
                testRunner.dumpAsText();
                testRunner.waitUntilDone();
                gc = function() { window.GCController.collect() };
            } else if (!window.gc)
                gc = function(){};

            window.onload = function() {
                if (location.hash != "#2") {
                    if (location.hash)
                        location.hash = "#" + (parseInt(location.hash.slice(1)) + 1).toString();
                    else
                        location.hash = "#1";
                    
                    gc();
                    setTimeout(function(){location.reload()}, 0);
                } else {
                    document.body.innerHTML = "PASS";
                    if (window.testRunner)
                        testRunner.notifyDone();
                }
            }
        </script>
    </body>
</html>