chromium/third_party/blink/web_tests/fast/block/basic/empty-anonymous-block-remove-crash.html

<html>
    <head>
        <script>
            if (window.testRunner)
            {
                testRunner.dumpAsText();
                testRunner.waitUntilDone();
            }
        
            function runTest()
            {
                var button = document.getElementById("test");
                button.insertBefore(document.createElement("tbody"), null);
                document.body.offsetTop;
                document.body.removeChild(button);
                
                var result = document.createElement("div");
                result.innerHTML = "PASS";
                document.body.appendChild(result);
                if (window.testRunner)
                    testRunner.notifyDone();
            }
        </script>
    </head>
    <body onload="runTest()">
        <button id="test"/>
    </body>
</html>