chromium/src/third_party/blink/web_tests/fast/js/exception-codegen-crash.html

<p>This page tests some conditions that used to cause crashes during codegen.
</p>
<p>If you don't crash, you pass.
</p>

<script>
if (window.testRunner)
    testRunner.dumpAsText();

var scripts = [
    "(1++).x;",
    "/^[s{-.[]()]$/.x;",
    "(++1).x;",
    "(1 = 1).x;"
];

try {
    eval(scripts.join("\n"));
} catch (e) {
}
</script>