LayoutTests/fast/rendering/render-text-control-crash-with-designmode-off.html

<style>
  body {
    container-type: size;
  }
</style>
<script>
  onload = () => {
    if (window.testRunner)
      testRunner.dumpAsText();
    document.designMode = 'off';
    i.type = 'radio';
    document.body.offsetHeight;
    document.body.innerHTML = 'PASS if no crash.';
  };
</script>
<input id="i">