chromium/third_party/blink/web_tests/fast/events/touch/touch-target-removed-crash.html

<!DOCTYPE html>
<html>
<body>
<p id="description">Test passes if no crash.</p>
<script>
if (window.testRunner) {

    testRunner.dumpAsText();

    function crash() {
        var div = document.createElement('div');
        div.ontouchstart = function() { };
        document.body.appendChild(div);
        internals.touchStartOrMoveEventHandlerCount(document);
        div.parentNode.removeChild(div);
        div = 0;
        if (window.GCController)
            GCController.collect();
        internals.touchStartOrMoveEventHandlerCount(document);
    }

    crash();
}
</script>
</body>