chromium/third_party/blink/web_tests/external/wpt/shadow-dom/invalidate-shadow-dom-crash.html

<style>
.c~*{}
</style>
<script>
document.addEventListener('DOMContentLoaded', () => {
  b.select()
  a.className = "c"
})
</script>
<details>
<summary id="a"></summary>
<textarea id="b">