chromium/third_party/blink/web_tests/fast/css/reload-non-styled-element-crash.html

<!DOCTYPE html>
<html>
<head>
<script>
    function start() {
        document.body.innerHTML='<p>laserator<p>#f'
        document.body.innerHTML = ''
        var m = document.createElementNS('http://www.w3.org/1998/Math/MathML','free');
        document.body.appendChild(m);
        if (!sessionStorage.started) {
            sessionStorage.started = true;
            location.reload();
        }
        document.body.offsetTop;
        document.body.innerHTML='PASS if no crash or assert in debug';
        if (window.testRunner)
            testRunner.dumpAsText();
    }
</script>
</head>
<body  onload='start()'></body>
</html>