chromium/third_party/blink/web_tests/fast/dom/shadow/shadow-selection-detach-crash.html

<!DOCTYPE html>
<script src="../../../resources/js-test.js"></script>
<div id="out"></div>
<script>
description("Garbage collection of Selection objects with shorter lifetimes must not crash.");
// A Selection object that dies before the window object it is registered to, must detach
// itself from its window on finalization.

self.jsTestIsAsync = true;
if (window.testRunner)
    testRunner.waitUntilDone();

function runTest() {
    var out = document.getElementById("out");
    var root = out.attachShadow({mode: 'open'});
    var sel = root.getSelection();
    document.body.removeChild(out);
    root = sel = out = null;
    gc();
    testPassed("No crash, including on shutdown..?");
    finishJSTest();
}
window.onload = runTest;
</script>