LayoutTests/svg/use-element-updateUserAgentShadowTree-crash.html

<!DOCTYPE html><!-- webkit-test-runner [ MutationEventsEnabled=true ] -->
<html>
<body>
<script>
if (window.testRunner) {
    testRunner.waitUntilDone();
    testRunner.dumpAsText();
}

function subtreeModifiedEventhandler() {
}

onload = () => {
    useElement.setAttribute("attributeType", "CSS");
    useElement.lastElementChild.textContent = "foo";
    menuItemElement.addEventListener("DOMSubtreeModified", subtreeModifiedEventhandler);
    setTimeout(() => {
        if (window.testRunner)
            testRunner.notifyDone();
    }, 0);
}
</script>
<p>This test passes if it doesn't crash.</p>
<svg skewX(0)">
<use id="useElement">
<animate onend="" />
</use>
<use xlink:href="#useElement" />
<menuitem id="menuItemElement" ismap="ismap">
</body>
</html>