chromium/third_party/blink/web_tests/custom-elements/array-squat-crash.html

<!DOCTYPE html>
PASS if this does not crash
<script>
if (window.testRunner) {
  testRunner.dumpAsText();
}

class X extends HTMLElement {
  connectedCallback() {
  }
};

Object.defineProperty(Array.prototype, 0, {
  set: function(value) {
    throw 'barf';
  },
  enumerable: true
});

customElements.define('x-x', X);
</script>