chromium/third_party/blink/web_tests/svg/dom/SVGAnimatedListPropertyTearOff-crash-2.html

<!DOCTYPE html>
<html>
<body>
<script src="../../resources/js-test.js"></script>
<script>
    description("This tests SVGAnimatedListPropertyTearOff containing SVGTransform don't crash if modified after contextElement goes out of scope.");

    var pattern = document.createElementNS("http://www.w3.org/2000/svg","pattern");
    var baseVal = pattern.patternTransform.baseVal;
    pattern = null;
    gc();

    var svgTransform = document.createElementNS("http://www.w3.org/2000/svg","svg").createSVGTransform();
    baseVal.insertItemBefore(svgTransform, 0);
    gc();

    debug("This test passes if we don't crash.");
</script>
</body>
</html>