chromium/third_party/blink/web_tests/fast/dom/MutationObserver/mutation-callback-dead-context-crash.html

<div id=test><iframe src="#test" onload="setTimeout(crash, 0)"></iframe></div>
<script>
if (window.testRunner) {
  testRunner.dumpAsText();
  testRunner.waitUntilDone();
}
var observer = new MutationObserver(function() {});
observer.observe(document.querySelector('#test'), { attributes: true });
function crash() {
  if (window.top === window) {
    var iframe = document.querySelector('iframe');
    var otherDocument = document.implementation.createDocument("http://www.w3.org/1999/xhtml", "html");
    otherDocument.adoptNode(iframe.contentDocument.documentElement);
    otherDocument.documentElement.appendChild(iframe);
    gc();
    setTimeout(function() {
      console.log('Test passes if it prints this message without crashing');
      testRunner.notifyDone();
    }, 0);
  }
}
</script>