third_party/WebKit/LayoutTests/fast/parser/math-options-crash.html

<script src="../../resources/dump-as-markup.js"></script>
This test passes if it doesn't crash.
<math><option><option></html><option></option>