chromium/src/third_party/blink/web_tests/fast/css/document-rare-data-style-crash.html

<!-- Test for crbug.com/638102 -->
<p>Test for crash when a Document with rare data's style is accessed</p>
<p>PASS if does not crash in debug</p>
<svg>
  <rect height="15rem" id="rect"></rect>
</svg>
<script>
  doc = document.implementation.createDocument("", "");
  doc.appendChild(rect);
  doc.childNodes[0];
  doc.documentElement['height']['baseVal']['value'];
</script>