chromium/third_party/blink/web_tests/svg/custom/use-href-attr-removal-crash.html

<!DOCTYPE html>
<p>PASS if no crash.</p>
<svg>
  <symbol id="a"><rect width="100" height="100" fill="blue"/></symbol>
  <use id="b" xlink:href="#a"></use>
  <rect id="c" width="100" height="100" fill="red"/>
</svg>
<script>
if (window.testRunner)
  testRunner.dumpAsText();

onload = function() {
  var use = document.getElementById('b');
  use.removeAttribute("xlink:href");
  var symbol = document.getElementById("a");
  symbol.appendChild(document.getElementById("c"));
  use.setAttribute("height", "100");
}
</script>