third_party/WebKit/LayoutTests/fast/css/sticky/overflow-layer-removed-crash.html

<style>
.scroll {
    overflow: hidden;
}

.layer {
    will-change: transform;
}
</style>
<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}

function crash() {
    document.getElementById('scroll').classList.remove('scroll');
    document.getElementById('scroll').classList.remove('layer');
    document.getElementById('layer').classList.remove('layer');
    if (window.testRunner)
        testRunner.notifyDone();
}

window.onload = function() {
    // Call crash after 2 rafs.
    requestAnimationFrame(requestAnimationFrame.bind(null, crash));
}
</script>
<p>This test PASSES if it does not CRASH.</p>
<div id="scroll" class="scroll layer">
    <div class="layer">
        <div id="layer" class="layer"></div>
    </div>
</div>