Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/external/wpt/css/selectors/invalidation/crashtests/nth-child-of-attribute-crash.html 

<!doctype html>
<meta charset="utf-8">
<style>
#elements [blue] {
    color: blue;
}
#elements :nth-child(1 of :not([blue])) {
    color: revert;
}
</style>
<div id="elements">
  <div blue>Child 1</div>
  <div>Child 2</div>
</div>
<script>
requestAnimationFrame(() =>
    requestAnimationFrame(() => {
        elements.children[1].setAttribute("blue", "");
        elements.children[1].removeAttribute("blue");
        elements.children[0].removeAttribute("blue");
    }));
</script>