chromium/third_party/blink/web_tests/fast/forms/saved-state-adoptNode-crash.html

<select id="select">
    <option>Truffles</option>
</select>
<textarea id="textarea">
Marshmallows
</textarea>
<iframe id="iframe" src="data:text/html,"></iframe>
<input type="password" id="password" value="seikooC">
<script>
    if (window.testRunner) {
        testRunner.dumpAsText();
        testRunner.waitUntilDone();
    }

    var newDoc = document.getElementById("iframe").contentDocument;
    newDoc.adoptNode(document.getElementById("select"));
    newDoc.adoptNode(document.getElementById("textarea"));
    newDoc.adoptNode(document.getElementById("password"));
    location.href = "../../resources/notify-success.html";
</script>