chromium/third_party/blink/web_tests/external/wpt/html/semantics/forms/the-input-element/input-type-change-empty-crash.html

<script>
document.addEventListener('DOMContentLoaded', () => {
  a.type = "foo"
  document.execCommand("insertHorizontalRule", false)
  a.type = "text"
})
</script>
<input id="a" type="color">