chromium/third_party/blink/web_tests/svg/animations/svglength-element-removed-crash.svg

<svg xmlns="http://www.w3.org/2000/svg" onload="load()">
This test passes if it doesn't crash when run under gmalloc.
<rect x="10" y="10" width="100" height="100" fill="green"/>
<text x="50" y="50" id="log"/>
<script>
<![CDATA[
function log(message) {
    var logDiv = document.getElementById('log');
    logDiv.appendChild(document.createTextNode(message));
}

function load() {
    if (window.testRunner && window.GCController && window.internals)
        testRunner.dumpAsText();
    else {
        log("This test only works when run with the testRunner, GCController, and internals available.");
        return;
    }

    var rect = document.getElementsByTagName("rect")[0];
    var baseValReference = rect.x.baseVal;

    rect.parentNode.removeChild(rect);
    rect = null;

    GCController.collect();

    // This line will crash with gmalloc if this test has regressed.
    log("PASS x = " + baseValReference.value);
}
]]>
</script>
</svg>