move-marquee-crossing-treescope-crash.html

<!DOCTYPE html>
<body>
<div id='div1'></div>
<div id='div2'></div>
<marquee id='marquee1'><marquee id='marquee2'>
<script>
// Test for crbug.com/439319

if (window.testRunner)
    testRunner.dumpAsText();

// Minimized https://cluster-fuzz.appspot.com/testcase?key=4788573801807872
function runTest() {
    var doc1 = document.implementation.createDocument("", null);
    div1.appendChild(marquee2);
    var doc2 = document.implementation.createDocument("http://www.w3.org/2000/svg", "svg", null);
    doc1.appendChild(doc2.documentElement);
    div2.parentNode.removeChild(div2);
    doc2.appendChild(div1);
    doc2.replaceChild(doc1.documentElement, doc2.childNodes[0]);
    gc();
    gc();
    doc2.documentElement.appendChild(marquee1);
    document.body.innerHTML = 'PASS';
}
document.addEventListener("DOMContentLoaded", runTest, false);
</script>
</body>

chromium/third_party/blink/web_tests/fast/dom/shadow/move-marquee-crossing-treescope-crash.html