state-restore-dynamic-controls-frame.html

<!DOCTYPE html>
<div></div>
<input type=checkbox disabled>
<input type=text disabled>
<script>
document.querySelector('div').innerHTML = '<input type=checkbox><input type=text>'
window.addEventListener('pageshow', () => {
  // This checkbox produces a FormControlState on leaving the document.
  // However, its state is never restored because it is added after 'pageshow'.
  // See crbug.com/1138598.
  let checkbox = document.createElement('input');
  checkbox.type = 'checkbox';
  checkbox.checked = false;
  document.body.appendChild(checkbox);

  parent.promiseResolver();
}, {once:true});

// This document produces FormControlStates like:
//    type        name value
// 1. "checkbox", "",  "on"
// 2. "text",     "",  "z"
// 3. "checkbox", "",  "off" (for the disabled one)
// 4. "text",     "",  "" (for the disabled one)
// 5. "checkbox", "",  "off" (for one added in the 'pageshow' handler)
</script>

chromium/third_party/blink/web_tests/fast/forms/resources/state-restore-dynamic-controls-frame.html