chromium/third_party/blink/web_tests/fast/dom/styled-clone-inline-style-decl-parent-crash.html

<!DOCTYPE html>
<html>
<head>
<script src="../../resources/js-test.js"></script>
</head>
<body>
Test passes if it does not crash.
<div id="console"></div>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

iframe1 = document.createElement('iframe');
document.body.appendChild(iframe1);
document1 = iframe1.contentDocument.implementation.createHTMLDocument("document");
var div1 = document1.createElement('div');
document1.body.appendChild(div1);
div1.style.color = "blue";
var div2 = div1.cloneNode(true);
document1.body.removeChild(div1);
delete document1;
gc();
div2.style.color = "red";

</script>
</body>
</html>