chromium/third_party/blink/web_tests/media/track/track-text-track-destructor-crash.html

<!DOCTYPE html>
<title>Tests that we don't crash when a media element that has text tracks is destructed.</title>
<script src="../../resources/gc.js"></script>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<script>
async_test(function(t) {
    var tracks = [];
    var video = document.createElement('video');
    for (var i = 0; i < 1000; i++)
        tracks[i] = video.addTextTrack('captions', 'Captions Track', 'en');
    assert_equals(tracks.length, 1000);
    // Destroy the video and force a garbage collection.
    video = 0;
    gc();
    setTimeout(t.step_func_done(), 0);
});
</script>