chromium/third_party/blink/web_tests/fast/canvas/canvas-toBlob-in-detached-document.html

<body>
PASS if no crash.
<div id="d">
<iframe id="i"></iframe>
<canvas id="c"></canvas>
</div>
<script>
if (window.testRunner)
  testRunner.dumpAsText();

var canvas = document.getElementById("c");
i.contentDocument.body.appendChild(d);
canvas.toBlob(() => {});
</script>
</body>