chromium/third_party/blink/web_tests/fast/forms/textarea/textarea-node-removed-from-document-crash.html

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xht="http://www.w3.org/1999/xhtml">
    <script type="text/javascript">
        if (window.testRunner)
        {
            testRunner.dumpAsText();
            testRunner.waitUntilDone();
        }
        
        function runTest()
        {
            var elements = document.getElementsByTagNameNS('http://www.w3.org/1999/xhtml','html');
            elements[0].textContent = "PASS";
            
            if (window.testRunner)
                testRunner.notifyDone();
        }
    </script> 
    <xht:object>
        <input autofocus="" onfocus="runTest();"/> 
        <xht:textarea></xht:textarea>
    </xht:object>
</html>