LayoutTests/fast/dom/HTMLInputElement/input-value-and-type-change-crash.html

<input id=input>
Pass if no crash.
<script>
if (window.testRunner)
    testRunner.dumpAsText();
    
function eventhandler() {
    document.body.offsetHeight;
}

input.addEventListener("DOMSubtreeModified", eventhandler);
document.execCommand("selectAll", true);

input.value = "foobar";
input.type = "button";
</script>