chromium/third_party/blink/web_tests/fast/dom/shadow/host-wrapper-reclaimed.html

<!DOCTYPE html>
<html>
<head>
<script src="../../../resources/js-test.js"></script>
</head>
<body>
<script>
function makeOrphanShadow() {
    var host = document.createElement("div");
    var shadow = host.attachShadow({mode: 'open'});
    return shadow;
};

var shadow = makeOrphanShadow();
gc(true);

try { shadow.innerHTML = "Hello"; } catch(e) { }
shadow.appendChild(document.createElement("span"));

document.body.innerHTML = "PASS unless crash.";
</script>
</body>
</html>