chromium/third_party/blink/web_tests/fast/css-grid-layout/grid-element-embed-crash.html

<!DOCTYPE html>
<style>
* {
    margin-right:2vw;
}
body {
    display:grid;
    grid-auto-flow:row stack;
}
</style>
<script>
if (window.testRunner)
    testRunner.dumpAsText();
</script>
<body>The test checks that embedded elements don't leave stale pointers into the grid representation.
    <embed>This test has passed if it didn't crash.</embed>
</body>