chromium/third_party/blink/web_tests/svg/text/inline-text-destroy-attributes-crash.xhtml

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<defs>
    <text id="text1">
        <tspan id="tspan1" x="906" y="250">Test passes it if does not crash</tspan>
        <tspan id="tspan2" x="447" y="108">PASS</tspan>
    </text>
</defs>
<use id="use1" xlink:href="#text1"/>
<text id="text2"></text>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();

    var range = document.createRange();
    range.setStart(document.getElementById("use1"), 0);
    range.setEnd(document.getElementById("text2"), 0);
    (new XMLSerializer()).serializeToString(range.extractContents());
    document.getElementById('text1').clientTop;
    range.surroundContents(document.getElementById("tspan1"));
</script>
</svg>