LayoutTests/svg/custom/svg-element-destructor-iteration-crash.html - WebKit - Git at Google

 <html xmlns="http://www.w3.org/1999/xhtml">
     <script type="text/javascript">
       if (window.testRunner) {
           testRunner.dumpAsText();
           testRunner.waitUntilDone();
       }
       onload = function() {
         if (location.hash != '#2') {
           if (location.hash == '')
             location.hash = '#1';
           else
             location.hash = "#" + (parseInt(location.hash.slice(1)) + 1).toString();
           setTimeout(function(){ location.reload() }, 0);
         } else {
           document.body.innerText = 'PASS: WebKit did not crash in Asan or assert in Debug.';
           if (window.testRunner)
             testRunner.notifyDone();
         }
       }
     </script>

     <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
         <font>
             <font-face font-family="any" id="foo"></font-face>
             <use xlink:href="#foo">
                <set attributeName="text-anchor"></set>
             </use>
         </font>
     </svg>
 </html>
	<html xmlns="http://www.w3.org/1999/xhtml">
	<script type="text/javascript">
	if (window.testRunner) {
	testRunner.dumpAsText();
	testRunner.waitUntilDone();
	}
	onload = function() {
	if (location.hash != '#2') {
	if (location.hash == '')
	location.hash = '#1';
	else
	location.hash = "#" + (parseInt(location.hash.slice(1)) + 1).toString();
	setTimeout(function(){ location.reload() }, 0);
	} else {
	document.body.innerText = 'PASS: WebKit did not crash in Asan or assert in Debug.';
	if (window.testRunner)
	testRunner.notifyDone();
	}
	}
	</script>

	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
	<font>
	<font-face font-family="any" id="foo"></font-face>
	<use xlink:href="#foo">
	<set attributeName="text-anchor"></set>
	</use>
	</font>
	</svg>
	</html>