chromium/src/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-template-element/template-element/template-content-in-inactive-document-crash.html

<iframe id="i"></iframe>
<script>
var t = i.contentDocument.createElement("template");
i.contentDocument.documentElement.appendChild(t);
i.remove();
t.content;
</script>