access-document-of-detached-stylesheetlist-crash.html

<!DOCTYPE html>
<html>
<head>
<script src="../../../resources/js-test.js"></script>
<script>
if (window.testRunner)
    testRunner.waitUntilDone();

function runTest()
{
    var host = document.getElementById('host');
    var sr = host.attachShadow({mode: 'open'});
    sr.innerHTML = '<style>background-color: red;</style><div>Shadow</div>';

    // Need to use ShadowRoot.styleSheets API to create a styleSheetList.
    sr.styleSheets.length;
    host.parentNode.removeChild(host);

    setTimeout(function() {
        gc();

        if (window.testRunner)
            testRunner.notifyDone();
    }, 0);
}
</script>
</head>
<body onload="runTest()">
  <div id='host'></div>
  <pre id='console'></pre>
</body>
<script>
description('Test for crbug.com/337059: accessing StyleSheetList::document() from GC causes crash.');
</script>
</html>

chromium/third_party/blink/web_tests/fast/dom/shadow/access-document-of-detached-stylesheetlist-crash.html