smil-in-shadow-tree-crash.html | Explore in Territory

<!DOCTYPE html>
<html>
    <script>
        if (window.testRunner)
            testRunner.dumpAsText();

        function start() {
            iFrame = document.createElement('iframe');
            document.getElementById('store_div').appendChild(iFrame);
            shadowRoot = document.getElementById('rootDiv').attachShadow({mode: 'open'});
            svgRoot = iFrame.contentDocument.createElementNS('http://www.w3.org/2000/svg','set');
            shadowRoot.appendChild(svgRoot);
        }
    </script>
    <body onload="start()">
      <div id="rootDiv">
        <div id="store_div"></div>
      </div>
      <p>Test PASSES if it does not assert in debug builds.</p>
    </body>
</html>

chromium/third_party/blink/web_tests/svg/custom/smil-in-shadow-tree-crash.html