chromium/third_party/blink/web_tests/loader/iframed-image-reparent-crash.html

<!DOCTYPE html>
<html>
  <iframe id="iframeElement" src="resources/image.gif"></iframe>
  <script src="../resources/testharness.js"></script>
  <script src="../resources/testharnessreport.js"></script>
  <script>
    var test = async_test('re-parented image document should clear pointers on re-parenting');

    test.step(function() {
      document.addEventListener(
        "DOMContentLoaded",
        function() { setTimeout("reparent()", 100); }, false);
    });

    function reparent() {
      newDoc = document.implementation.createDocument(
        "http://www.w3.org/1999/xhtml", "html");
      newDoc.adoptNode(iframeElement.contentDocument.documentElement);
      assert_true(true, "Re-parented successfully");
      test.done();
    }
  </script>
</html>