chromium/third_party/blink/web_tests/svg/custom/detached-outermost-svg-crash.html

<script>
if (window.testRunner)
    testRunner.dumpAsText();

var svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
for (prop in svg) {
    // Access all the properties on the <svg> element
    // at least one of them (like viewport) will call SVGSVGElement::isOutermostSVG()
    // and will trigger the crash seen in https://bugs.webkit.org/show_bug.cgi?id=25105
    svg[prop];
}
</script>
<div>PASSED -- webkit did not crash in SVGSVGElement::isOutermostSVG().  See https://bugs.webkit.org/show_bug.cgi?id=25105</div>