chromium/third_party/blink/web_tests/fast/forms/fieldset/fieldset-adoptnode-crash.html

<!DOCTYPE html>
<html>
<body>

<div id=parentDiv>
  <div id=aDiv></div>
  <fieldset id=aFieldSet form=noSuch></fieldset>
</div>

<script>
testRunner.dumpAsText();
testRunner.waitUntilDone();

(function() {
  var aDivShadow = aDiv.attachShadow({mode: 'open'});
  var bDiv = document.createElement("div");
  aDivShadow.appendChild(bDiv);

  var createdDoc = document.implementation.createDocument("http://www.w3.org/1999/xhtml", "html");
  createdDoc.adoptNode(aDiv);
  bDiv.appendChild(parentDiv);
})();

gc();

setTimeout(function() {
    var url = window.location.toString();
    if (0 < url.indexOf("**")) {
        document.body.innerHTML = "PASS unless crash.";
        return testRunner.notifyDone();
    }

    if (-1 == url.indexOf("?"))
        url += "?";
    url += "*";
    window.location = url;
}, 0);

</script>
</body>
</html>