chromium/third_party/blink/web_tests/fast/dom/cssTarget-crash.html

<html>
<body>
<div><a href="rdar://4504805&4577323&4643028&5659812">Should not crash.</a></div>
<form name="f" method="GET" action="#a"></form>
<div id="anchors"><a name="a"></a></div>
<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}

var stopped = false;
setTimeout("doIt()", 1);
setTimeout("stopped = true;", 100);
function doIt() {
    if (stopped) {
        if (window.testRunner)
            testRunner.notifyDone();
        return;
    }
    document.forms.f.submit();
    var x=Math.random();
    setTimeout("doIt("+x+")",10);
    document.forms.f.action="#"+x;
    document.getElementById("anchors").innerHTML+=
        "<img width=100 height=100><a name=\""+x+"\"></a>";
}
</script>
</body>
</html>