form-submission-crash-successful-submit-button.html

<!DOCTYPE html>
<body>
<script src="../../resources/js-test.js"></script>
<script>
jsTestIsAsync = true;
var form1;
var submit1;

function start() {
    form1 = document.createElement('form');
    submit1 = document.createElement('input');
    submit2 = document.createElement('input');
    submit1.type = 'submit';
    submit2.type = 'image';
    form1.addEventListener('submit', handleSubmit, false);
    form1.action = 'javascript:removeImage()';
    form1.appendChild(submit1);
    form1.appendChild(submit2);
    document.body.appendChild(form1);
    submit1.click();
    testPassed('if not crashed.');
    finishJSTest();
}

function handleSubmit() {
    form1.removeChild(submit1);
}

function removeImage() {
    form1.removeChild(submit2);
    submit2 = null;
    gc();
}

window.onload = start;
</script>
</body>

chromium/third_party/blink/web_tests/fast/forms/form-submission-crash-successful-submit-button.html