chromium/third_party/blink/web_tests/fast/css/cloneNode-after-deleteRule-crash.html

<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<script src="../../resources/js-test.js"></script>
</head>
<body>
<script>

function runtest() {
    q = document.getElementsByTagName('object')[0].contentDocument;
    q.styleSheets[0].deleteRule(1);
    q.getElementsByTagName('head')[0].cloneNode(true);
}

description("This test checks that mutating a stylesheet and then using cloneNode() in a subdocument doesn't cause a crash.");

</script>
<object data="resources/cloneNode-after-deleteRule-subdocument.html" onload="runtest()"/>
</body>
</html>