chromium/third_party/blink/web_tests/intersection-observer/incomplete-document.html

<!DOCTYPE html>
<script>
if (window.testRunner)
  testRunner.dumpAsText();
</script>

<p>PASS if no crash.</p>

<div id=root>
  <div id=target></div>
</div>

<script>
var root = document.getElementById("root");
var target = document.getElementById("target");
var observer = new IntersectionObserver((changes) => {}, {root: root});
onload = () => {
  var newdoc = document.implementation.createDocument("http://www.w3.org/1999/xhtml", "html");
  newdoc.adoptNode(root);
  observer.observe(target);
}
</script>