Reported by mailto:lokihardt@google.com, Feb 2 2017
This is a regression test from https://crbug.com/456518.
ContainerNode::parserRemoveChild doesn't detach subframes unlike ContainerNode::removeChild. As a result, it could lead to UXSS.
Tested on Safari 10.0.3(12602.4.8).
Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=1110