Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/fast/layout/subtree-layout-with-javascript-navigate-crash.html 

<!DOCTYPE html>
<body>
<input value="boom">
<script>
if (window.testRunner) {
  testRunner.waitUntilDone();
  testRunner.dumpAsText();
}

var input = document.getElementsByTagName('input')[0];
function explode() {
  var value = input.value;
  if (value) {
    input.value = value.substr(0, value.length - 1);
    window.setTimeout(explode, 0);
  } else {
    window.location.href="javascript:'Test passes if no crash with ASAN.'";
    if (window.testRunner)
      testRunner.notifyDone();
  }
}
explode();
</script>