Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/fast/dom/shadow/gc-collected-shadowroot-crash.html 

<!doctype html>
<meta content="style-src 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='" http-equiv="Content-Security-Policy"/>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function func() {
    div1.attachShadow({mode: 'open'}).innerHTML="<style></style>";

    var doc0 = document.implementation.createDocument("http://www.w3.org/2000/svg", "svg", null);
    var doc1 = document.implementation.createDocument("", null);

    doc1.appendChild(doc0.documentElement);
    doc0.appendChild(div1);
    doc0.replaceChild(doc1.documentElement, doc0.childNodes[0]);
    gc();
    gc();

    document.write("PASS");
}
</script>
<body onload="func()">
<div id="div1"></div>
</body>