chromium/third_party/blink/web_tests/svg/css/path-layout-crash.html

<!DOCTYPE HTML>
<style></style>
This test passes if it does not crash<br>
<svg id="svg" style="position: absolute;">
    <path class="c3"></path>
</svg>
<svg>
    <use xlink:href="#svg"></use>
</svg>
<script>
if (window.testRunner) {
    testRunner.waitUntilDone();
    testRunner.dumpAsText();
}
onload = function() {
    document.body.offsetTop;
    document.styleSheets[0].insertRule('.c3 { border: 5px solid red; } ', '.c3');
    if (window.testRunner)
        testRunner.notifyDone();
}
</script>