chromium/third_party/blink/web_tests/fast/forms/image/image-border-attribute-crash.html

<!DOCTYPE html>
<body>
<script src="../../../resources/js-test.js"></script>
<div id="testDiv"></div>
<script>
description("Tests that we don't crash when parsing an input element with a border attribute and image type.");

var testDiv = document.getElementById("testDiv");
testDiv.innerHTML = "<input border='0' type='image' src='submit.gif' alt='Submit'>";

var input = testDiv.firstChild;
shouldBeEqualToString("input.getAttribute('border')", "0");
shouldBeEqualToString("input.getAttribute('type')", "image");
shouldBeEqualToString("input.getAttribute('src')", "submit.gif");
shouldBeEqualToString("input.getAttribute('alt')", "Submit");

</script>
</body>