chromium/third_party/blink/web_tests/external/wpt/streams/transferable/gc-crash.html

<!DOCTYPE html>
<html class="test-wait">
<script src="/common/gc.js"></script>
<script type="module">
  const b = new ReadableStream({
    start(c) {
      c.enqueue({}) // the value we will transfer
    },
  })
  const transferred = structuredClone(b, { transfer: [b] })
  // Here we request a read, triggering a message transfer
  transferred.getReader().read()
  // And immediately trigger GC without waiting for the read,
  // causing the actual transfer to be done after GC
  await garbageCollect()
  document.documentElement.classList.remove("test-wait")
</script>