chromium/third_party/blink/web_tests/svg/animations/target-move-relative-length-invalidation-crash.html

<!DOCTYPE html>
<svg>
  <g id="g1">
    <text id="text1"/>
  </g>
  <g id="g2">
    <text id="text2"/>
    <animate values="100" href="#text2" attributeName="x" dur="4s"/>
  </g>
</svg>
<p>PASS if no crash</p>
<script>
if (window.testRunner) {
  testRunner.dumpAsText();
  testRunner.waitUntilDone();
}
var g1 = document.getElementById("g1");
var g2 = document.getElementById("g2");
var text1 = document.getElementById("text1");

window.onload = function() {
  requestAnimationFrame(function() {
    g1.remove();
    text1.appendChild(document.querySelector("svg"));
    g1.appendChild(g2);
    if (window.testRunner)
      testRunner.notifyDone();
  });
};
</script>