object-set-type-with-no-data-crash.html

<!DOCTYPE html>
<object id="target" type="text/html"></object>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<script>
  test(()=> {
    var target = document.getElementById("target");
    target.type = "text/html";
  }, "No crash or DCHECK failure");
</script>

chromium/third_party/blink/web_tests/fast/replaced/object-set-type-with-no-data-crash.html