chromium/src/third_party/blink/renderer/core/testing/data/setup_scrollbar_layer_crash.html - manifest_repos/chromium_src - Git at Google

 <!DOCTYPE html>
 <html>
 <head>
 <script>
 function runtest() {
     var iframe = document.getElementById("iframe");
     iframe.src = "javascript:'A'";
     iframe.scrollTop;
     iframe.src = "javascript:''";
 }
 </script>
 </head>
 <body onload="runtest()">
 <iframe id="iframe" style="width:1px;height:1px;"></iframe>
 </body>
 </html>
	<!DOCTYPE html>
	<html>
	<head>
	<script>
	function runtest() {
	var iframe = document.getElementById("iframe");
	iframe.src = "javascript:'A'";
	iframe.scrollTop;
	iframe.src = "javascript:''";
	}
	</script>
	</head>
	<body onload="runtest()">
	<iframe id="iframe" style="width:1px;height:1px;"></iframe>
	</body>
	</html>