SVGPolygonElement-baseVal-list-removal-crash.html

<html>
<head>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function go() {
    var oSVGPolygon = document.createElementNS("http://www.w3.org/2000/svg", "polygon");
    var svgRoot = document.createElementNS("http://www.w3.org/2000/svg", "svg");
    var oSVGPoint1 = svgRoot.createSVGPoint();
    oSVGPolygon.points.initialize(oSVGPoint1);
    oSVGPolygon.points.removeItem(-9223372036854775802);
    alert("Accessing old oSVGPoint1.x: " + oSVGPoint1.x);
}
</script>
</head>
<body onload="go()">
This test passes if it doesn't crash.
</body>
</html>

chromium/third_party/blink/web_tests/svg/dom/SVGPolygonElement-baseVal-list-removal-crash.html