chromium/third_party/blink/web_tests/fast/forms/search/search-type-change-crash.html

<!DOCTYPE html>
<body>
<script src="../../../resources/testharness.js"></script>
<script src="../../../resources/testharnessreport.js"></script>
<div id="container">
<style></style>
<input id="input" type="time" onblur="this.type = 'search';">
</div>
<script>
var test = async_test('No crash by changing type on blur.');
window.onload = test.step_func_done(() => {
  document.querySelector('#input').focus();
  document.querySelector('#container').style.display = 'none';
  document.querySelector('#input').value = '23:59';
});
</script>
</body>