chromium/third_party/blink/web_tests/external/wpt/accessibility/crashtests/inert-br-child.html

<!DOCTYPE html>
<!-- Test for crash when inert br gains illegal child -->
<html>
<dialog></dialog>
<br>

<script>
requestAnimationFrame(() => {
  requestAnimationFrame(() => {
    document.querySelector('dialog').showModal();
    const br = document.querySelector('br');
    br.appendChild(document.createElement('fieldset'));
  });
});
</script>

</html>