LayoutTests/fast/forms/saved-state-adoptNode-crash.html

<select id="select">
    <option>Truffles</option>
</select>
<textarea id="textarea">
Marshmallows
</textarea>
<iframe id="iframe" src="data:text/html,"></iframe>
<input type="password" id="password" value="seikooC">
<script>
    if (window.testRunner) {
        testRunner.dumpAsText();
        testRunner.waitUntilDone();
    }

    var newDoc = document.getElementById("iframe").contentDocument;
    newDoc.adoptNode(document.getElementById("select"));
    newDoc.adoptNode(document.getElementById("textarea"));
    newDoc.adoptNode(document.getElementById("password"));
    location.href="data:text/html,SUCCESS<script>if (window.testRunner) testRunner.notifyDone()</scr" + "ipt>";
</script>