tests/tests/webkitsecurity/assets/svglength-animation-retarget-crash.html

<p>This test verifies that SVG animation targets can change during the animation.</p>
<p id="result"></p>
<svg id="svg">
    <text id="text"></text>
    <animate xlink:href="#text" id="a" attributeName="y" begin="0.0" from="0" to="1" dur="1s" repeatCount="indefinite">
</svg>
<script>
if (window.layoutTestController) {
    layoutTestController.dumpAsText()
    layoutTestController.waitUntilDone()
}

setTimeout(function() {
    text = document.getElementById('text')
    text.id = 'not_text'
    svg = document.getElementById('svg')
    svg.id = 'text'
    svg.appendChild(document.getElementById('a').cloneNode())
    setTimeout(function() {
      document.getElementById("result").innerText = "TEST PASSED"
      if (window.layoutTestController)
          layoutTestController.notifyDone()
    }, 0)
}, 0)
</script>