4 <script type=
"application/javascript">
6 // Crashes if 'target' doesn't get properly unlinked in FragmentOrElement::Unlink
9 var target = document.createElement('div');
10 // By setting a custom prop we create a cycle between JS and C++ that requires the CC to break.
12 var io = new IntersectionObserver(function () { }, { });
18 <body onload=
"crash()">