chromium/third_party/blink/web_tests/svg/custom/crash-inline-container-client.html

<svg>
<g>
<defs><linearGradient id="linearGradient"></linearGradient></defs>
<text style="fill:url(#linearGradient);">
  B<tspan>A</tspan>
</text>
<text style="filter:url(#dropShadow);">
  <tspan id="tspan">K</tspan>
</text>
</g>

<text x="10" y="30">This test passes if it does not crash.</text>

<script>
var canvas = document.createElement("canvas");
document.getElementById("linearGradient").appendChild(canvas);
range = document.createRange();
range.setEndAfter(document.getElementById("tspan"));
range.extractContents();

if (window.testRunner)
    testRunner.dumpAsText();
</script>
</svg>