chromium/third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/sandbox-toggle-in-inactive-document-crash.html

<body>
<iframe id="i"></iframe>
<script>
var saved_i = i;
var saved_i_doc = i.contentDocument;
i.remove();
saved_i_doc.adoptNode(saved_i);
saved_i.sandbox.toggle("1");
</script>