chromium/third_party/blink/web_tests/html/sections/body-clone-link-decl-parent-crash.html

<!DOCTYPE html>
<html>
<head>
<script src="../../resources/js-test.js"></script>
</head>
<body>
Test passes if it does not crash.
<div id="console"></div>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

iframe1 = document.createElement('iframe');
document.body.appendChild(iframe1);
document1 = iframe1.contentDocument.implementation.createHTMLDocument("document");
var body1 = document1.body;
document1.alinkColor = "blue";
var body2 = body1.cloneNode(true);
document1.body = document1.createElement('body');
delete document1;
gc();
body2.vLink = 1;

</script>
</body>
</html>