chromium/third_party/blink/web_tests/fast/frames/iframe-double-attach.html

<html>
<head>
    <style>
    /* a descendant rule makes us so sophisticated (and crash-prone) */
    pre div { color: brown; }
    </style>
    <script>
        function runTest()
        {
            if (window.testRunner)
                testRunner.dumpAsText();
                
            // first, make sure the target needs style recalc
            target.style.backgroundColor = "white";
            target.innerHTML = '<div><IFRAME></IFRAME><img></div>';
        }
    </script>
    
</head>
<body onload="runTest()">
<div id="target"></div>
<div>SUCCESS! Didn't crash</div>
</body>
</html>