chromium/third_party/blink/web_tests/fast/forms/fieldset/fieldset-shadowdom-crash.html

<!DOCTYPE html>
<html>
<head>
<script>
testRunner.dumpAsText();
testRunner.waitUntilDone();

function test() {
    (function() {
        var fieldsetElement = null;

        (function() {
            var divElement = document.createElement("div");
            var divShadow = divElement.attachShadow({mode: 'open'});
            fieldsetElement = document.createElement("fieldset");
            containerSpan.appendChild(fieldsetElement);
            divShadow.appendChild(containerSpan);
            fieldsetElement.setAttribute("form", "form");
        })();

        gc(); // Expecting divShadow being reclaimd.
    })();

    gc(); // Expecting fieldsetElement being reclaimd.

    setTimeout(function() {
        document.body.innerHTML = "PASS unless crash.";
        testRunner.notifyDone();
    }, 0);
}

document.addEventListener("DOMContentLoaded", test, false);
</script>
</head>
<body >
  <span id=containerSpan></span>
</body>
</html>