chromium/third_party/blink/web_tests/fast/css/remove-stylesheet-from-shadow-form-crash.html

<!DOCTYPE html>
<style></style>
<p>PASS if no crash.</p>
<div id="div"></div>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();

    var div = document.getElementById("div");
    var shadowRoot = div.attachShadow({mode: 'open'});
    shadowRoot.innerHTML = "<form><input></input></form>";

    // Force a style recalc.
    getComputedStyle(document.body).color;

    var input = shadowRoot.querySelector("input");
    input.appendChild(document.createElement("style"));
    input.remove();
</script>