Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/hittest-detached-iframe-crash.html 

<!DOCTYPE html>
<script>
function test() {
  document.body.offsetHeight;
  document.body.attachShadow({mode: 'closed'});
  iframe.contentDocument.caretRangeFromPoint(0, 0);
}
</script>
<iframe id="iframe" onload="test()"></iframe>