chromium/third_party/blink/web_tests/media/track/track-removal-crash.html

<!DOCTYPE  html>
<title>Tests that removing track nodes while their parent is being deleted doesn't crash</title>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<label id="label1">
  <video autoplay>
      <!-- Can't use findMediaElement() as test doesn't crash, so source needs to be specified here -->
      <source src="../content/test.ogv">
      <source src="../content/test.mp4">
      <track src="captions-webvtt/captions-fast.vtt">
      <track src="captions-webvtt/captions-fast.vtt">
  </video>
</label>
<script>
async_test(function(t) {
    document.getElementsByTagName('track')[0].track.mode = 'showing';
    document.getElementsByTagName('track')[1].track.mode = 'showing';

    setTimeout(t.step_func(CFcrash), 10);

    function CFcrash() {
        document1  =  document.implementation.createDocument('',  null);
        document1.appendChild(label1);

        delete document1;

        setTimeout(t.step_func_done(runGCAndEndTest), 0);
    }

    function runGCAndEndTest() {
        gc();
        // No crash. PASS.
    }
});
</script>