chromium/third_party/blink/web_tests/media/media-controls-clone-crash.html

<html>
    <body onload="runTest();">
        Test passes if it does not crash.
        <script>
            if (window.testRunner)
            {
                testRunner.dumpAsText();
                testRunner.waitUntilDone();
            }

            function runTest() {
                node = document.createElement('audio');
                node.setAttribute('src', 'foo');
                node.setAttribute('controls', 'foo');
                node.style.fontWeight = '100';
                var clone = node.cloneNode(false);
                clone.load();
 
                if (window.testRunner)
                    setTimeout("testRunner.notifyDone()", 0);
            }
        </script>
    </body>
</html>