chromium/third_party/blink/web_tests/fast/forms/lazy-event-listener-scope-chain.html

<!DOCTYPE html>
<script src="../../resources/js-test.js"></script>
<form action="javascript:void(0)" onsubmit="runTest(username.value)">
<input type="text" value="abc" name="username">
<input type="submit" name="login" value="Login">
</form>
<script>

description('This test tests that a lazy event listener attached to a form element keeps its form in the scope chain when the listener is called by JavaScript.');

var result;

function runTest(x)
{
    result = x;
    shouldBeEqualToString('result', 'abc');
}

var f = document.querySelector('form');

f.onsubmit();

// Should keep the ObjectEnvironment even when called without context.
(0, f.onsubmit)();

f.oldF = f.onsubmit;

f.onsubmit = function() {
    this.oldF();
};

f.login.click();

</script>
<script src="../../resources/js-test.js"></script>