chromium/third_party/blink/web_tests/svg/custom/resources-svgdom-invalidation-crash.svg

<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
  <!-- Test for http://crbug.com/311548 -->
  <g>
    <rect width="100" height="100" fill="green" filter="url(#filter)"/>
  </g>

  <defs>
    <filter id="filter" filterUnits="userSpaceOnUse" x="0" y="0" width="100" height="100" filterRes="400">
      <feOffset/>
    </filter>
  </defs>

  <text>PASS: did not crash.</text>

  <script>
    if (window.testRunner)
      testRunner.dumpAsText();

    setTimeout(function() {
      document.getElementById('filter').setAttribute('width', 99);
    }, 0);
  </script>
</svg>