chromium/third_party/blink/web_tests/svg/animations/smil-element-target-crash-main.html

<!DOCTYPE html>
<html>
<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}

function crash()
{
    var doc = document.implementation.createDocument(null, "");
    doc.adoptNode(object1.contentDocument.getElementsByTagName("svg")[0]);
    delete doc;

    if (window.GCController)
        GCController.collect();

    document.open();
    document.write('PASS');
    document.close();

    if (window.testRunner)
        testRunner.notifyDone();
}

function runTest()
{
    setTimeout("crash()", 0);
}
</script>
<object data="resources/smil-element-target-crash.svg" id="object1" onload="runTest()"></object>
<iframe id="iframe1"></iframe>
</html>