<!DOCTYPE html>
PASS if no crash.
<script>
function run() {
    if (window.testRunner)
        testRunner.dumpAsText();

    let e = document.createElement("input");
    frames[0].document.body.offsetTop;
    document.body.append(e);
    frames[0].document.body.append(e);
}
</script>
<iframe onload="run()"></iframe>