chromium/third_party/blink/web_tests/fast/dom/text-node-attach-crash.xhtml

<html xmlns="http://www.w3.org/1999/xhtml">
Test passes if it does not crash.
<style></style>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

var docElement = document.documentElement;
document.removeChild(docElement); 
window.onload = function() {
    document.appendChild(docElement);
};
</script>
</html>