chromium/third_party/blink/web_tests/svg/custom/pattern-3-step-cycle-dynamic-1.html

<!DOCTYPE html>
<script src="../../resources/run-after-layout-and-paint.js"></script>
<script>
if (window.testRunner) {
  testRunner.dumpAsText();
  window.onload = function() {
    runAfterLayoutAndPaint(mutateTree, true);
  };
}
function mutateTree() {
  // A reference from the 'rect' to the pattern cycle.
  document.getElementsByTagName('rect')[0].setAttribute('fill', 'url(#p1)');
}
</script>
<p>PASS if no crash (stack overflow).</p>
<svg width="100" height="100">
  <rect width="100" height="100"/>
  <pattern id="p3" width="1" height="1">
    <rect fill="url(#p1)" width="100" height="100"/>
  </pattern>
  <pattern id="p2" width="1" height="1">
    <rect fill="url(#p3)" width="100" height="100"/>
  </pattern>
  <pattern id="p1" width="1" height="1">
    <rect fill="url(#p2)" width="100" height="100"/>
  </pattern>
</svg>