LayoutTests/svg/custom/polyline-points-crash.html

<script>
if (window.testRunner)
    testRunner.dumpAsText();

var polyline = document.createElementNS("http://www.w3.org/2000/svg", "polyline");
try {
    polyline.points.appendItem(null);
} catch (e) {
    document.write("Caught exception: " + e + "<br>");
}
document.write("PASSED -- WebKit did not crash!")
</script>