chromium/third_party/blink/web_tests/fast/forms/past-names-crash.html

<!DOCTYPE html>
<html>
<body>
<script src="../../resources/js-test.js"></script>
<div id="container">
<table>
<form id="form1">
<td>
<input name="q"/>
<script>
jsTestIsAsync = true;
var form1 = document.getElementById("form1");
var container = document.getElementById("container");
form1['q'];
container.innerHTML = '';
setTimeout(function() {
    container.insertBefore(form1, null);
    gc();
    container.innerHTML = 'PASS if not crashed.';
    finishJSTest();
}, 0);
</script>
</td>
</form>
</table>
</div>
</body>
</html>