chromium/third_party/blink/web_tests/svg/custom/crash-textPath-attributes.html

<iframe src="resources/crash-textPath-attributes-iframe.svg" onload="go(this)"></iframe>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();

    function go(oIframe) {
      var oSelection = oIframe.contentWindow.getSelection();
      oSelection.selectAllChildren(oIframe.contentDocument);
      oSelection.deleteFromDocument();
    }
</script>
<p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=62439">Update SVG position values on SVG DOM updates</a></p>
<p>This test PASSES if he does not crash</p>