Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/html/text_level_semantics/a-ping-no-crash.xhtml 

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script><![CDATA[
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}

function crash()
{
    cur_obj = document.createElement('a');
    eval('cur_obj.search = false;');
    eval('cur_obj.hostname = navigator;');
    eval('cur_obj.ping = false;');
    e_value = eval('cur_obj.click();');
    if (window.testRunner)
        testRunner.notifyDone();
}
]]></script>
</head>
<body onload="crash();">
</body>
</html>