third_party/blink/web_tests/editing/shadow/505092-fieldset-is-not-ua-shadow-crash.html

<script>
if (window.testRunner)
    testRunner.dumpAsText();

var n = document.createElement('fieldset');
document.documentElement.appendChild(n);
try { n.createShadowRoot(); } catch(e) {}
n.appendChild(document.createElement('div'));

onload = function() {
    document.execCommand("selectall");
};
</script>This test passes if it does not crash