chromium/third_party/blink/web_tests/fast/loader/move-own-container-into-child-iframe-crash.html

<!DOCTYPE html>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<div id="container">
  <object onload="object_loaded()" type="application/ecmascript">
    <iframe id="iframe"></iframe>
  </object>
</div>
<script>
  t = async_test("Should not crash");
  function object_loaded() {
      iframe.contentDocument.adoptNode(container);
      t.done();
  }
</script>