remove-shadowroot-from-document-and-destroy-crash.html

<!DOCTYPE html>
<meta content="style-src 'sha256-47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU='" http-equiv="Content-Security-Policy"/>
<head>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

onload = function() {
    div1.attachShadow({mode: 'open'}).innerHTML="<style>";
    var svgDoc = document.implementation.createDocument("http://www.w3.org/2000/svg", "svg", null);
    var doc = document.implementation.createDocument("", null);
    doc.appendChild(svgDoc.documentElement);
    svgDoc.appendChild(div1);
    svgDoc.replaceChild(doc.documentElement, svgDoc.childNodes[0]);
    gc();
    document.write("PASS");
}
</script>
</head>
<body>
<div id="div1"></div>
</body>

chromium/third_party/blink/web_tests/fast/dom/shadow/remove-shadowroot-from-document-and-destroy-crash.html