chromium/third_party/blink/web_tests/fast/css/synchronous-hash-update-crash.html

<!DOCTYPE html>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<script>
  test(() => {
    var s = document.createElement("style");
    s.appendChild(document.createTextNode('@import url(dummy.css);'));
    document.head.insertBefore(s, null);
    var d = document.createElement("div");
    d.setAttribute("id", "x");
    document.head.appendChild(d);
    location.hash= "#x";
    document.documentElement.remove();
    document.appendChild(document.createElement("html"));
  }, "This test should not crash.");
</script>