chromium/third_party/blink/web_tests/svg/foreignObject/foreignObject-position-crash.html

<!doctype html>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<script src="../../resources/run-after-layout-and-paint.js"></script>
<style>
  svg { position: relative }
</style>
This test passes if it does not crash.

<svg style="position:relative">
  <foreignObject>
    <div id="target" style="">test</div>
  </foreignObject>
</svg>

<script>
onload = () => {
  async_test(t => {
    runAfterLayoutAndPaint(t.step_func_done(() => {
      target.style.position='relative';
    }));
  });
};
</script>