chromium/third_party/blink/web_tests/svg/custom/svg-image-layers-crash.html

<!DOCTYPE html>
<html>
  <!-- Test for https://code.google.com/p/chromium/issues/detail?id=266542 -->
  <body>
    PASS: did not crash.
    <script>
      var img = new Image();
      img.src = 'data:image/svg+xml;charset=utf-8,' +
        '<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200">' +
            '<foreignObject width="100%" height="100%">' +
                '<div xmlns="http://www.w3.org/1999/xhtml" style="transform: matrix3d(1, 0, 0, 0, 0, -1, 0, 0, 0, 0, 1, 0, -770, -270, 0, 1);">Transform Me</div>' +
            '</foreignObject>' +
        '</svg>';

      if (window.testRunner)
        testRunner.dumpAsText();
    </script>
  </body>
</html>