image-error-event-modifies-type-crash.html

<!DOCTYPE html>
<html>
  <body>
    <script>
      if (window.testRunner) {
        testRunner.waitUntilDone();
        testRunner.dumpAsText();
      }
      function eventhandler() {
        inputNode = document.getElementById("imageInput");
        inputNode.type = "";
        setTimeout("cleanup()", 10);
      }

      function cleanup() {
        if (window.testRunner)
        {
            testRunner.notifyDone();
        }
      }
    </script>
    <input>
      <input id="imageInput" type="image" onerror="eventhandler()" src="http://127.0.0.1/not-likely-to-be-found.html" />
    </input>
    Test Passes if it does not crash.
  </body>
</html>

chromium/third_party/blink/web_tests/fast/forms/image/image-error-event-modifies-type-crash.html