chromium/third_party/blink/web_tests/fast/forms/form-control-element-crash.html

<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}
if (window.eventSender) {
    // Repeat to increase chance of crash.
    for (i = 0; i < 1000; i++) {
        setTimeout(function() {
            eventSender.mouseMoveTo(75,75);
        }, 0);
    }
    setTimeout(function() { if (window.testRunner) { testRunner.notifyDone(); } }, 0);
}
</script>
Generated by cluster-fuzz. This test passes if it doesn't crash.
<div id="result"><fieldset><input id="test" type="button"></fieldset></div>
<script>
    eventSender.mouseMoveTo(test.offsetLeft, test.offsetTop, ["metaKey"]);
    document.getElementById("result").innerHTML = "a";
</script>