chromium/third_party/blink/manual_tests/remove-form-node-with-radio-buttons-crash.html

<html>
<script type="text/javascript">

function load1() {
  var doc = document.getElementById("container");
  doc.innerHTML = "<form name=\"gaga\"><input type=\"radio\" name=\"asdf\" id=\"chk\" value=\"A\"> Checkbox 1" +
                                      "<input type=\"radio\" name=\"asdf\"            value=\"B\"> Checkbox 2";
  document.getElementById("chk").checked = true;
}

function load2() {
  var doc = document.getElementById("container");
  doc.innerHTML = "hello, world";
}

var ctr = 0;

function runTest() {
  if (ctr % 2 == 0) {
    load1();
  } else {
    load2();
  }
  ctr++;
  setTimeout("runTest()", 10);
}
</script>
<body>
<div>This is a test for http://bugs.webkit.org/show_bug.cgi?id=12938 - to test this, press the "Run Test" button and wait for a couple of minutes - the browser should not crash.</div>
<input type="button" onclick="runTest()" value="Run Test">
<div id="container"/>

</body></html>