chromium/third_party/blink/web_tests/fast/forms/fieldset/fieldset-crash.html

<!DOCTYPE html>
<html>
Test passes if it does not crash.
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function onloadHandler()
{
    var fieldsets = document.getElementsByTagName("fieldset");
    fieldsets[1].disabled = true;
}
</script>
<body onload="onloadHandler();">
<fieldset>
<fieldset>
</fieldset>
</fieldset>
</body>
</html>