chromium/third_party/blink/web_tests/fast/dom/shadow/tree-scope-crash.html

<!DOCTYPE html>
<html>
<head>
<script src="../../../resources/dump-as-markup.js"></script>
<script>
RELOAD_THRESHOULD = 10;

if (window.testRunner)
    testRunner.waitUntilDone();

Markup.noAutoDump();
    
function assertMarkup(name, element, expected)
{
    var markup = Markup.get(element);
}

function currentCount()
{
   var match = /=(.*)/.exec(window.location.search)
   if (!match)
       return 0;
   return parseInt(match[1]);
}

function runTest()
{
    var items = document.getElementsByTagName('li');
    document.getElementById('testReplace').outerHTML = '<progress> node';
    assertMarkup('replace', items[0], '| \n|   "Replaced"\n| " node using outerHTML."');

    
    var count = currentCount();
    if (RELOAD_THRESHOULD <= count && window.testRunner) {
        testRunner.notifyDone();
        return;
    }

    document.getElementById("counter").value = (count + 1).toString();
    document.getElementById("theForm").submit();
}
</script>
</head>
<body onload="runTest()">
<h1>PASS unless crash</h1>
<ul>
  <li><span id="testReplace"></span></li>
</ul>
<form id="theForm">
  <input id="counter" name="counter" value="">
<form>
</body>
</html>