chromium/third_party/blink/web_tests/fast/dom/inline-event-attributes-lookup-removed-form.html

<!DOCTYPE html>
<script src="../../resources/js-test.js"></script>
<form id="test-form">
    <input id="test-input">
</form>
<script>

description('Tests that lookup in inline event handlers keeps references alive');

var result;
var pa = '(FAIL input)'
var ss = '(FAIL form)'

var input = document.getElementById('test-input');
input.pa = 'PA';
input.form.ss = 'SS';
input.setAttribute('onclick', 'result = pa + ss');

var f = input.onclick;

input.parentNode.removeChild(input);
input = null;
gc();

f();
shouldBeEqualToString('result', 'PASS');

</script>