chromium/third_party/blink/web_tests/svg/custom/animate-reference-crash.html

<!DOCTYPE HTML>
<!-- Test for WK90042 - Passes if there is no crash and "PASS" is displayed. -->
<html>
<body>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

var textElement = document.createElementNS("http://www.w3.org/2000/svg", "text");
document.documentElement.appendChild(textElement);
var aElement = document.createElementNS("http://www.w3.org/2000/svg", "a");
var animateElement = document.createElementNS("http://www.w3.org/2000/svg", "animate");
aElement.appendChild(animateElement);
document.implementation.createDocument("", "", null).adoptNode(aElement);
for (something in animateElement)
    animateElement[something];
textElement.appendChild(animateElement);
textElement.parentNode.removeChild(textElement);

// Not crashing at this point means we PASS.
document.body.innerHTML = "PASS";
</script>
</body>
</html>