chromium/third_party/blink/web_tests/fast/forms/image/image-error-event-crash.html

<!DOCTYPE html>
<html>
<body>
Test passes if it does not crash.
<input id="x" type="image" onerror="x.type=''" src="" />
<script>
if (window.testRunner)
    testRunner.dumpAsText();
</script>
</body>
</html>