Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/fast/dom/MutationObserver/disconnect-transient-crash.html 

<!DOCTYPE html>
<div>Test passes if it does not crash</div>
<script>
if (window.testRunner) testRunner.dumpAsText();
var div = document.createElement('div');
var span = document.createElement('span');
div.appendChild(span);
var observer = new MutationObserver(function(){});
observer.observe(div, { attributes: true, subtree: true });
div.removeChild(span); // cause span to become transiently observed
div = null;
gc(); // collect div's wrapper
observer.disconnect();
</script>