chromium/third_party/blink/web_tests/svg/custom/svg-length-value-crash.svg

<svg xmlns="http://www.w3.org/2000/svg">
  <!-- Test for http://crbugs.com/317484 -->
  <rect width="100" height="100" fill="green"/>
  <text y="230">PASS: did not crash.</text>
  <script>
    if (window.testRunner)
      testRunner.dumpAsText();

    var w = document.rootElement.width.baseVal.value;
    var h = document.rootElement.height.baseVal.value;
  </script>
</svg>