Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/external/wpt/css/cssom/insert-dir-rule-in-iframe-crash.html 

<!DOCTYPE html>
<title>CSSOM Test: Chrome crash inserting :dir rule in iframe</title>
<link rel="help" href="https://crbug.com/1486351">
<p>PASS if no crash.</p>
<iframe srcdoc='<!DOCTYPE html>
                <style id="sheet"> </style>
                <div id="host"></div>
                <script>
                  let root = host.attachShadow({mode:"open"});
                  root.innerHTML = "<slot></slot>";
                  host.offsetTop;
                  host.innerHTML = "<span>Green</span>";
                  sheet.sheet.insertRule("html:dir(ltr) { color: green; }");
                  getComputedStyle(host).color;
                </script>
                '>
</iframe>