testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/sandbox-toggle-in-inactive-document-crash.html


1
2
3
4
5
6
7
8
9

<body>
<iframe id="i"></iframe>
<script>
var saved_i = i;
var saved_i_doc = i.contentDocument;
i.remove();
saved_i_doc.adoptNode(saved_i);
saved_i.sandbox.toggle("1");
</script>