append-child-style-crash.html | Explore in Territory

<!DOCTYPE html>
<body>
<script>
function callback() {
    style0.innerHTML = '';
    script0.removeChild(style0);
}

style0=document.createElement('style');
style0.innerHTML = 'span { color: blue; }';

script0=document.createElement('script');
script0.innerHTML = "callback();";
script0.appendChild(style0);
document.body.appendChild(script0);

if (window.testRunner)
    testRunner.dumpAsText();
</script>
<p>PASS unless crash</p>
</body>

chromium/third_party/blink/web_tests/fast/dom/HTMLScriptElement/append-child-style-crash.html