chromium/third_party/blink/web_tests/fast/dom/destroy-selected-radio-button-crash.html

<html>
<script>
function runTest() {
    if (window.testRunner)
        testRunner.dumpAsText();

    document.getElementById('container').innerHTML = '';
    document.getElementById('radio').checked = true;
}
</script>
<body onload="runTest()">
    <div>This tests that destroying a checked radio button that does not have a form correctly removes the radio button element from the checked radio buttons map. This test should ideally be run with GuardMalloc or a similar memory checker.</div>
    <div>SUCCESS - Didn't crash!</div>
    <div id="container"><input name="a" type="radio" checked></div>
    <input name="a" id="radio" type="radio">
</body>
</html>