The attached file raised the following assertion: ASSERTION FAILED: !m_code || m_code == defaultExceptionCode ../../Source/WebCore/svg/animation/SVGSMILElement.cpp(205) :
Created attachment 207248 [details] testcase
I can't reproduce this on trunk.
Created attachment 210465 [details] Test case
I also can reproduce it with the second test case.
I am unable to reproduce this issue with r204037. If you are able to reproduce the problem, could you reopen this bug with a revised test case?