chromium/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-template-element/template-element/template-set-inner-html-in-inactive-document-crash.html

<iframe id="i"></iframe>
<script>
  var doc = i.contentDocument;
  i.remove();
  doc.createElement("template").innerHTML = "";
</script>