chromium/third_party/blink/web_tests/fast/dom/MutationObserver/weak-callback-gc-crash.html

<!DOCTYPE html>
<div>Test passes if it does not crash</div>
<script src="../../../resources/gc.js"></script>
<script>
if (window.testRunner) {
    testRunner.waitUntilDone();
    testRunner.dumpAsText();
} 
var observer, div;

function initializeObserver() {
    observer = new MutationObserver(
                   function() {console.log('MutationObserver callback')});
    div = document.createElement('div');
    observer.observe(div, {attributes: true});
    div.id = 'foo';
}

// Do initialization work in an inner function to avoid references to objects
// remaining live on this function's stack frame (http://crbug.com/595672/).
initializeObserver();
div = null;
observer = null;
gc();
setTimeout(function() { testRunner.notifyDone(); }, 0);
</script>