chromium/src/third_party/blink/web_tests/http/tests/svg/tref-adoptNode-crash.html

<script>
// Test passes if it does not crash.
// Note: this test is located under Layouttests/http in order to load an external
//       document (svg-tref.svg) and modify it without hitting security restrictions.
    if (window.testRunner) {
        testRunner.waitUntilDone();
        testRunner.dumpAsText();
    }

    function crash() {
        q = document.getElementById('root').contentDocument;
        var z = document.lastChild;
        q.adoptNode( z );
        e = document.importNode( q.firstChild, true );
        q.adoptNode( e );
        r = document.createRange();
        r.surroundContents( e );
        e.id = 's';
        document.write("If this text is visible and the test did not crash, this test passes");
        document.close();
        if (window.testRunner)
            testRunner.notifyDone();
    }
</script>
<object data="http://127.0.0.1:8000/svg/resources/svg-tref.svg" id="root" onload="crash()"/>