chromium/third_party/blink/web_tests/fast/forms/checkbox/checkbox-change-event-free.html

<!DOCTYPE html>
<body>
<script src="../../../resources/js-test.js"></script>
<label><input type=checkbox></label>
<script>
var label = document.querySelector('label');
var checkbox = document.querySelector('input');
checkbox.addEventListener('change', function() {
  this.removeAttribute('type');
});
label.click();
testPassed("No crash after changing type on change event.");
</script>
</body>