chromium/third_party/blink/web_tests/fast/forms/form-associated-element-crash3.html

<body>
<script>
if (window.testRunner)
    testRunner.dumpAsText();
</script>
This test passes if it doesn't crash.  Note: You might need to reload this test
many times (or run the test under valgrind / ASAN) to see a crash.
<span>
<span>
<video src="javascript:" onloadstart>
<form  id="tjbvp"></form>
</video>
</span>
</span>
<keygen form="woujt">
</body>