chromium/third_party/blink/web_tests/svg/masking/mask-valid-reference-wrong-element-type-crash.html

<!DOCTYPE html>
<svg mask="url(#f)">
  <filter id="f"/>
</svg>
<p>PASS if no crash in debug</p>
<script>
if (window.testRunner)
  testRunner.dumpAsText();
</script>