chromium/src/third_party/blink/web_tests/fast/events/xhr-onclick-crash.html

This test passes if it doesn't crash.
<script>
if (window.testRunner)
    testRunner.dumpAsText();

testRunner.waitUntilDone();
xhr = new XMLHttpRequest();
xhr.open('GET', 'resources/onclick.html', true);
xhr.responseType = 'document';
xhr.onload = function () {
    var r = this.responseXML;
    var td = r.getElementById('foo');
    td.children[0].onclick;
    testRunner.notifyDone();
};
xhr.send();
</script>