chromium/third_party/blink/web_tests/http/tests/object/remote-frame-crash.html

<!doctype HTML>
<object style="all: inherit;" id="target" data="http://localhost:8000/object/resources/test.html"/>
Test passes if it does not crash.
<script>
if (window.testRunner) {
    window.testRunner.waitUntilDone();
    window.testRunner.dumpAsText();
}
function go() {
  target.setAttribute("classid", "test");
  if (window.testRunner)
    window.testRunner.notifyDone();
}
requestAnimationFrame(() => requestAnimationFrame(go));
</script>