third_party/blink/web_tests/fast/dom/NamedNodeMap-setNamedItem-crash.html

<script>
    if (window.testRunner)
        testRunner.dumpAsText();

    onload = function()
    {
        document.body.attributes.setNamedItem(null);
    }
</script>
This passes if it does not crash.  (see https://bugs.webkit.org/show_bug.cgi?id=18958)