chromium/third_party/blink/web_tests/media/track/media-element-enqueue-event-crash.html

<!DOCTYPE  html>
<title>Tests that appending events for dispatching doesn't crash.</title>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<script src="../../resources/gc.js"></script>
<video autoplay>
    <track src="captions-webvtt/captions-fast.vtt" default>
</video>
<script>
async_test(function(t) {
    if (localStorage.testRuns)
        localStorage.testRuns = Number(localStorage.testRuns) + 1;
    else {
        localStorage.testRuns = 1;
        localStorage.totalRuns = 5;
    }

    document.querySelector("track").track.mode = "showing";
    setTimeout(t.step_func(CFcrash), 100);

    function CFcrash() {
        var video = document.querySelector("video");
        video.src = "content/test.ogv";
        var document1 = document.implementation.createDocument("", null);
        document1.appendChild(video);
        delete document1;

        setTimeout(t.step_func(forceGC), 0);
    }

    function forceGC() {
        gc();

        // End the test only if it ran totalRuns.
        if (localStorage.testRuns == localStorage.totalRuns)
            t.done();
        else
            location.reload();
    }

});
</script>