Version: 54.0.2810.2 canary (64-bit)
OS: OSX 10.11.5 (15F34)

What steps will reproduce the problem?

Run following snippit in browser:

customElements.define('x-foo', class extends HTMLElement {
  constructor() {
    super();
    console.log('created', this.localName);
  }
  connectedCallback() {
    console.log('connected', this.localName);
    this.attachShadow({mode:'open'}).
      appendChild(document.createElement('div'));
    this.shadowRoot.firstChild.innerHTML = 'Hi in shadow';
  }
});
var foo = document.createElement('x-foo');
var doc = document.implementation.createHTMLDocument();
doc.body.appendChild(foo); // << Crashes
console.assert(Boolean(doc.body.firstChild.shadowRoot));


What is the expected output?

No crash, assert passes

What do you see instead?

Tab crashes