chromium/third_party/blink/web_tests/fast/forms/control-detach-crash.html

<!DOCTYPE html>
<html>
<body>
<script>
// We had an assertion failure in FormController::unregisterFormElementWithState.
if (window.testRunner)
    testRunner.dumpAsText();
var d = document.createElement('div');
var s = document.createElement('script');
s.textContent = 'document.currentScript.parentNode.remove();';
d.appendChild(s);
d.appendChild(document.createElement('input'));
document.body.appendChild(d);
document.body.innerHTML = 'PASS';
</script>
</body>
</html>