Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/fast/forms/select/select-generated-content.html 

<html>
<head>
<style>
.s1::before { display: table; content: counter(section); }
.s2::after { display: table; content: counter(section); }
</style>
<script>
function boom() {
    var s1 = document.createElement('select');
    s1.setAttribute('class', 's1');
    document.documentElement.appendChild(s1);
    var s2 = document.createElement('select');
    s2.setAttribute('class', 's2');
    document.documentElement.appendChild(s2);
    if (window.testRunner)
        testRunner.dumpAsText();
}
window.onload = boom;
</script>
<head>
<body>PASS unless crash.</body>
</html>