Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/fast/dom/HTMLStyleElement/style-onload-remove-crash.html 

<!DOCTYPE html>
<body>
<script src="../../../resources/js-test.js"></script>
<div></div>
<script>
myDiv = document.body.querySelector("div");

newStyle = document.createElement("style");
newStyle.onload = function() { document.body.appendChild(myDiv); }
document.body.appendChild(newStyle);

newDiv = document.createElement("div");
// Inserting <iframe> into tree flushes the pending @onload event.
newDiv.innerHTML = "<iframe></iframe><style></style>";
myDiv.attachShadow({mode: 'open'}).appendChild(newDiv);

debug("PASS unless crash");
</script>
</body>