Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/svg/dom/SVGTransformList-crash.html 

<html>
<body>
<svg id='svg'>
    <circle id="c" transform="scale(2, 2)"/>
</svg>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

var svg = document.getElementById("svg");
var circle = document.getElementById("c");
var t = svg.createSVGTransform();
var matrix = c.transform.baseVal.appendItem(t).matrix;
circle.transform.baseVal.getItem(0).matrix;
var t2 = svg.createSVGTransform();
circle.transform.baseVal.appendItem(t2);
matrix.a;
</script>
This test passes if it did not crash on ASAN.
</body>
</html>