object-onfocus-mutation-crash.html | Explore in Territory

<!DOCTYPE html>
<html>
<body>
<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}

function finish() {
    if (window.testRunner)
        testRunner.notifyDone();
}

function crash() {
    document.body.innerHTML = "PASS. WebKit didn't crash.";
    setTimeout("finish()", 0);
}
</script>
<object data="a">
<input autofocus="" onfocus="crash()">
</object>
</body>
</html>

chromium/third_party/blink/web_tests/plugins/object-onfocus-mutation-crash.html