chromium/chrome/test/data/password/password_form_action_mutation.html

<!doctype html>
<html>
<head>
  <base href="done">

<script>

function state_changed(xhr) {
  if (xhr.readyState == 4) {
    // Make form action mutation delayed so as that AjaxSucceeded handler
    // can be run first. AjaxSucceded handler should start observing form
    // mutations by form tracker.
    setTimeout(function() {
        document.getElementById('form_with_action_mutation').setAttribute('action', 'done.html');

        // Event on XHR finish should be sent a bit later to make browser react
        // on form action mutation.
        setTimeout(function() {
            window.domAutomationController.send("XHR_FINISHED");
        }, 0)
    }, 0);
  }
}

function send_xhr() {
  var xhr = new XMLHttpRequest();
  xhr.onreadystatechange = function() { state_changed(xhr); };
  xhr.open("GET", "password_form_action_mutation.html", true);
  xhr.send(null);
}

</script>
</head>
<body>

<form method="POST" action="dummy" id="form_with_action_mutation"
      onsubmit="send_xhr(); return false;">
  <input type="text" id="username_action_mutation" name="username_action_mutation">
  <input type="password" id="password_action_mutation" name="password_action_mutation">
  <input type="submit" id="submit_action_mutation" name="submit_action_mutation">
</form>

</body>
</html>