chromium/third_party/blink/web_tests/svg/text/empty-text-node-crash.html

<!DOCTYPE html>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<svg id="svg">
<g id="g"></g>
<text id="text">Fail</text>
</svg>
<script>
test(function() {
    // Create an empty text node through the editing apis.
    var oSelection=window.getSelection();
    document.execCommand('SelectAll', false, false)
    var oRange = oSelection.getRangeAt(0);
    oRange.insertNode(g);
    // Force the text length to be calculated.
    text.getComputedTextLength();
    svg.parentElement.removeChild(svg);
}, 'Empty text nodes should not crash.');
</script>