chromium/third_party/blink/web_tests/fast/events/keyevent-iframe-removed-crash.html

<!DOCTYPE html>
<html>
<head>
<script src="../../resources/gc.js"></script>
<script>
    function go() {
        var fr = document.createElement('iframe');
        fr.id = "blorp";
        document.body.appendChild(fr);
        fr.contentDocument.body.innerHTML = '<p id="a">move mouse out of the window, and press a key</p>';
        fr.contentDocument.body.onkeydown = function(e) {
            e.preventDefault();
            document.body.removeChild(fr);
        };

        fr.focus();

        if (window.testRunner)
        {
            testRunner.dumpAsText();
            testRunner.waitUntilDone();
            setTimeout(nuke, 0);
        }
    }

    function nuke() {
        gc();
        eventSender.keyDown("x")
        testRunner.notifyDone();
    }
</script>
</head>

<body onload="go()">
    <p>
        This test passes if it does not crash. Move the mouse out
        of the window, and then press any key.
    </p>

    <p>
        PASS
    </p>
</body>
</html>