chromium/third_party/blink/web_tests/fast/dom/insertAdjacentHTML-afterend-crash.html

This test passes if it doesn't crash (or ASSERT).
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function free() {
  document.adoptNode(input);
  gc();
}

svg = document.createElementNS('http://www.w3.org/2000/svg','mover');
input = document.createElement('input');
svg.appendChild(input);
svg = null;
input.insertAdjacentHTML('afterend', '<section onload="free()"></section>');
</script>