chromium/third_party/blink/web_tests/dom/mutation-event-tests/fast/dom/shadow/cyclic-append-crash.html

<!DOCTYPE html>
If this does not crash, the test passed.

<div id="f1">
<div id="f2"></div>
</div>

<script>
if (window.testRunner)
    testRunner.dumpAsText();

var f3 = document.createElement('div');
var s2 = f2.attachShadow({mode: 'open'});
f1.addEventListener("DOMNodeRemovedFromDocument", function () {
  s2.appendChild(f3);
});
try {
    f3.appendChild(f1);
} catch (e) {
    console.log(e.message);
}
</script>