chromium/third_party/blink/web_tests/fast/html/input-type-change-crash.html

<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<script src="../../resources/js-test.js"></script>
</head>
<body>
<input type="text"/>
<script>

description("This test checks that changing the 'type' attribute on an input element without a 'value' attribute doesn't crash.");

var inputElement = document.getElementsByTagName("input")[0];

shouldBe("inputElement.type", "'text'");
inputElement.type = 'submit';
shouldBe("inputElement.type", "'submit'");

document.body.removeChild(inputElement);

</script>
</body>
</html>