chromium/third_party/blink/web_tests/fast/css/crash-layout-detached-document.html

<!DOCTYPE html>

<link id="sheet" href="doesnotexist.css" rel="stylesheet">

<p>Bug 377724: Don't crash when calling into layout on a detached document.</p>

<div id="first"></div>
<iframe id="iframe"></iframe>

<script>
onload = function() {
    if (window.testRunner)
        testRunner.dumpAsText();
    var iframeDocument = iframe.contentDocument;
    var link = document.createElement("link");
    link.href = "doesnotexist.css";
    link.rel = "stylesheet";
    document.getElementById("first").appendChild(document.getElementById("sheet"));
    iframeDocument.replaceChild(link, iframeDocument.documentElement);
    document.body.offsetTop;
    iframe.remove();
    iframeDocument.firstChild.offsetTop;
}
</script>