chromium/third_party/blink/web_tests/svg/foreignObject/invalid-svg-child-renderer.html

<!DOCTYPE html>
<html>
  <body>
    <div id="container"></div>

    PASS: test did not crash.

    <script>
      /* Build the following shadow tree structure to verify that <svg> elements always
       * receive a LayoutSVGRoot renderer when their parent is <foreignObject>:
       *   <svg>
       *     <foreignObject>
       *       <svg></svg>
       *     </foreignObject>
       *   </svg>
       */
      function create_shadow() {
        var root = document.getElementById('container').attachShadow({mode: 'open'});
        var svg1 = document.createElementNS('http://www.w3.org/2000/svg', 'svg');
        root.appendChild(svg1);
        var fo = document.createElementNS('http://www.w3.org/2000/svg', 'foreignObject');
        svg1.appendChild(fo);
        var svg2 = document.createElementNS('http://www.w3.org/2000/svg', 'svg');
        fo.appendChild(svg2);
      }

      if (window.testRunner) {
        create_shadow();
        testRunner.dumpAsText();
      }
    </script>
  </body>
</html>