third_party/WebKit/LayoutTests/svg/text/text-positioning-remove-child-crash.svg

<svg xmlns="http://www.w3.org/2000/svg">
    <text y="50">Test passes if it does not crash when run with libgmalloc.</text>
    <script>
        if (window.testRunner)
            testRunner.dumpAsText();
    </script>
    <text><a id="a"><tspan>FAIL</tspan></a></text>

<script><![CDATA[
var range = document.createRange();
range.selectNode(window.document.documentElement);
var selection = window.getSelection();
selection.removeAllRanges();
selection.addRange(range);
document.getElementById("a").textContent = "PASS";
]]></script>
</svg>