chromium/third_party/blink/web_tests/fast/dom/shadow/move-shadow-host-to-child-iframe-crash.html

<!DOCTYPE html>
<script src="../../../resources/testharness.js"></script>
<script src="../../../resources/testharnessreport.js"></script>
<div id="host">
    <iframe id="iframe"></iframe>
</div>
<script>
    test(() => {
        host.attachShadow({mode:"open"}).innerHTML = "<style></style>";
        iframe.contentDocument.documentElement.appendChild(host);
    }, "Inserting a shadow host with an iframe child into that iframes document should not crash or assert.");
</script>