feComponentTransfer-style-crash.xhtml

<html xmlns="http://www.w3.org/1999/xhtml">
<body>
<svg xmlns="http://www.w3.org/2000/svg">
<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}
window.onload = function()
{
    try {
        document.getElementById('tgt').type.baseVal=99999;
    } catch (e) {
        alert (e);
    }

    setTimeout(function () {
            document.body.innerHTML = "PASS";
            if (window.testRunner)
                testRunner.notifyDone();
        }, 0);
}
</script>
<defs><filter id="f"><feComponentTransfer><feFuncR type="identity" id="tgt"/></feComponentTransfer></filter></defs>
<text x="20" y="20" filter="url(#f)" style="fill:green" id="out">TESTING</text>
<rect width="128" height="128" style="fill:green" filter="url(#f)"/>
</svg>
</body>
</html>

chromium/third_party/blink/web_tests/svg/filters/feComponentTransfer-style-crash.xhtml