chromium/third_party/blink/web_tests/fast/dom/shadow/shadow-root-touch-listener-crash.html

<!DOCTYPE html>
<html>
<body>
<script src="../../../resources/js-test.js"></script>
<script src="resources/shadow-dom.js"></script>
<script src="resources/event-dispatching.js"></script>
<div id=target></div>
<script>
jsTestIsAsync = true;

function addTouchEventListeners(name)
{
    var node = getNodeInComposedTree(name);
    node.addEventListener('touchstart', recordEvent, false);
}

target.appendChild(
    createDOM('div', {'id': 'A'},
          createShadowRoot()));
addTouchEventListeners('A/');

setTimeout(function() {
    target.parentNode.removeChild(target);
    gc();
    debug("PASS unless crash");
    finishJSTest();
}, 0);
</script>
</body>
</html>