Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/fast/html/insert-selected-option-crash.html 

<!DOCTYPE html>
<p>You should see the word PASS below, and no crash.</p>
<p id="p">FAIL</p>
<script>
    p.offsetTop;
    p.innerHTML = "&nbsp;<form><select multiple><option selected></option></select><input max=1 min=1 type=number></form>";
    p.innerHTML = "PASS";
</script>