chromium/third_party/blink/web_tests/fast/dom/insertAdjacentHTML-DocumentFragment-crash.html

This test passes if it doesn't crash (or ASSERT).
<script>
if (window.testRunner)
    testRunner.dumpAsText();

var f = document.createDocumentFragment();
var s = document.createElement('div');
f.appendChild(s);
s.insertAdjacentHTML('afterend', "aaa");
</script>