chromium/third_party/blink/web_tests/fast/forms/text/textfield-onchange-deletion.html

<html>
<script>
    function test() {
        if (window.testRunner) {
            testRunner.dumpAsText();
            testRunner.waitUntilDone();
        }
        setTimeout(test2, 0);
    }
    function test2() {
        document.getElementById('tf').focus();
        eventSender.keyDown('a');
        eventSender.keyDown("\r", null);
        if (window.testRunner)
            testRunner.notifyDone();
    }
    function test3()
    {
        document.getElementById('tf').style.display = "none";
    }
    function log(msg) {
        var res = document.getElementById('res');
        res.innerHTML = res.innerHTML + msg + "<br>";
    }

</script> 
<body onload="test()">
    This tests that when the onchange event handler causes the renderer to be deleted, we don't crash.<br>
    To run this test manually, type a character in the field and hit enter.<br>
    <input id="tf" onchange="test3()">
    <br>
    <div id="res"></div>
</body>
</html>