chromium/src/third_party/blink/web_tests/svg/custom/tref-clone-crash.html

<svg xmlns:xlink="http://www.w3.org/1999/xlink" onload="runTest()">
  <defs>
    <style id="style"/>
    <text id="ref"></text>
  </defs>
  <g><use xlink:href="#ref"/></g>
  <g><text><tref id="tref" xlink:href="#ref"/></text></g>
  <script src="../../resources/gc.js"></script>
  <script>
    if (window.testRunner) {
      testRunner.dumpAsText();
      testRunner.waitUntilDone();
    }
    function runTest() {
      var tref = document.getElementById("tref");
      tref.cloneNode(true);
      gc();
      var elem = document.getElementById("style");
      var parent = elem.parentNode;
      parent.insertBefore(document.createElement("source"), elem);
      document.body.innerHTML = "PASS";
      if (window.testRunner)
        testRunner.notifyDone();
    }
  </script>
</svg>