third_party/blink/web_tests/rootscroller/remove-rootscroller-crash.html

<!--No DOCTYPE as the crash only occured without it-->
<script src="../resources/testharness.js"></script>
<script src="../resources/testharnessreport.js"></script>
<script>
  // This test passes if it doesn't crash.
  requestAnimationFrame(function () {
    document.addEventListener('DOMFocusOut', function () { document.open(); });
    document.designMode = "on";
    document.execCommand("SelectAll");
    document.body.outerText = "ABC";
  });
</script>

<style>
  body {
    margin: 0px;
  }
  #rootscroller {
    height: 100%;
    overflow: auto;
  }
</style>
<div id="rootscroller">
<script>
  var rootScroller = document.querySelector('#rootscroller');
  document.rootScroller = rootScroller;
  test(function() {
      assert_false(typeof document.rootScroller === 'undefined');
  }, "Didn't crash");
</script>