chromium/third_party/blink/web_tests/svg/custom/element-instance-held-by-js-crash.svg

<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
    <script>
    <![CDATA[
    window.onload = function() {
        // Grab a reference to an SVGElementInstance native object. This reference will prevent the
        // object from deletion when the shadow DOM is removed due to a style change.
        instance = document.getElementById("use_elem").instanceRoot;

        // Setting an attribute forces re-creation of the shadow DOM
        document.getElementById("circleID").setAttribute("cx", 30);

        // The animate element tries to modify the element, which tries to update the
        // instances in the circle, which crashes if it holds a pointer to a non-existent element.

        if (window.testRunner)
            testRunner.dumpAsText();
    }
    //]]>
    </script>
    <circle transform="translate(1)" id="circleID" fill="green" cy="15" cx="15" r="10" >
        <animate attributeName="cy" />
    </circle>
    <text id="resultText" y="20" x="50" >
      PASS - Null corresponding element dereference does not crash.
    </text>
    <use id="use_elem" xlink:href="#circleID" />
</svg>