stylesheet-candidate-node-crash-main.html

<!DOCTYPE html>
<html>
Test passes if it does not crash.
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function runTest() {
    svgdoc = document.getElementById('root').contentDocument;
    var style = document.createElement('style');
    var test1 = svgdoc.getElementById('test1');
    test1.appendChild(style);
    svgdoc.getElementById('test2').setAttribute('xlink:href', 0);
    svgdoc.getElementById('test').setAttribute('stroke', 0);
}
</script>
<object data="resources/stylesheet-candidate-node-crash.svg" id="root" onload="runTest();" type="image/svg+xml"></object>
</html>

chromium/third_party/blink/web_tests/svg/dom/stylesheet-candidate-node-crash-main.html