chromium/third_party/blink/web_tests/dom/node/appendChild-document-crash.html

<!DOCTYPE html>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<span id="e1"></span>
<span id="e2">
  <span id="e3"></span>
</span>
<script>
  test(() => {
      // This triggers a DCHECK when appendChild runs during another
      // appendChild.
      var e1 = document.getElementById("e1");
      var e2 = document.getElementById("e2");
      var e3 = document.getElementById("e3");
      var doc1 = document.implementation.createDocument("", "", null);
      doc1.appendChild(e2);

      e2.addEventListener(
          "DOMSubtreeModified", () => {e1.appendChild(e3)}, {once: true});
      e2.appendChild(e3);
  }, "appendChild between docs should not crash");
</script>