chromium/third_party/blink/web_tests/fast/events/focus-change-crash.html

<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<div>Type something into the first input and press tab.  The browser should not crash.</div>
<div id="parent">
<input id="a" />
<input id="b" />
</div>
<script>
document.getElementById("a").addEventListener("change", function(e) {
    var parent = document.getElementById("parent");
    parent.innerHTML = "<input id='c' />";
    document.getElementById("c").select();
}, false);

test(() => {
    document.getElementById("a").focus();
    if (!window.testRunner)
        return;
    eventSender.keyDown("x")
    eventSender.keyDown("\t");
}, "Typing followed by focus change doesn't crash");
</script>