move-style-element-to-inactive-document-crash.html

<!DOCTYPE html>
<body>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

onload = function() {
    var style = document.createElement("style");
    document.body.appendChild(style);
    var option = document.createElement("option");

    var newdoc = document.implementation.createDocument("", null);
    newdoc.appendChild(document.body);
    style.appendChild(option);

    document.body = document.createElement('body');
    document.body.innerHTML = 'PASS if no crash.';
}
</script>
</body>

chromium/third_party/blink/web_tests/fast/dom/move-style-element-to-inactive-document-crash.html