svg-matrix-tearoff-crash.html | Explore in Territory

<!DOCTYPE html>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function eventhandler1() {
    var transformList = document.createElementNS("http://www.w3.org/2000/svg", "radialGradient").gradientTransform.baseVal;
    var transform = document.querySelector("svg").createSVGTransform();
    transformList.appendItem(transform);
    var matrix = transform.matrix;
    transformList.initialize(transform);
    matrix.flipX();
}
</script>
This test passes if it doesn't crash under ASAN.
<svg onload="eventhandler1()">

chromium/third_party/blink/web_tests/svg/transforms/svg-matrix-tearoff-crash.html