chromium/third_party/blink/web_tests/fast/forms/text/input-element-attach-crash.html

<html>
    <head>
        <script>
            if (window.testRunner)
                testRunner.dumpAsText();
        </script>
    </head>
    <body>
        <button autofocus>
            <object>
                <select autofocus></select>
                <input>
                <span>
                <div></div>
                PASS
            </object>
            <object></object>
        </button>
    </body>
</html>