chromium/src/third_party/blink/web_tests/fast/frames/iframe-setattr-crash-without-body.html

<script>
function eventhandler() {
  ifr.marginHeight = "20";
  ifr.scrolling = "no";
}
</script>
<iframe id="ifr" srcdoc="tp<p style='position: absolute; top: 1000px;'>Hello world!</p>&lt;w"></iframe>
<audio>
<source onerror="eventhandler()">