Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/svg/dom/baseVal-animVal-list-crash.html 

<html>
<head>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function go() {
    var oSvgTextElement = document.createElementNS("http://www.w3.org/2000/svg", "text");
    var oSvgRectElement = document.createElementNS("http://www.w3.org/2000/svg", "rect");
    oSvgTextElement.y.animVal;
    oSvgTextElement.y.baseVal.initialize(oSvgRectElement.x.baseVal);
    oSvgTextElement.y.animVal.getItem(0);
}
</script>
</head>
<body onload="go()">
This test passes if it doesn't crash.
</body>
</html>