chromium/third_party/blink/web_tests/fast/forms/update-from-element-during-editing-crash-2.html

<!DOCTYPE html>
<html>
<body>
<style>
div + * {}
</style>
<p id="container"><textarea>a
</textarea></p>
<script>

if (window.testRunner)
    testRunner.dumpAsText();

var textarea = document.getElementsByTagName('textarea')[0];
textarea.focus();
textarea.selectionStart = 1;
textarea.selectionEnd = 1;
document.execCommand('InsertLineBreak', false, null);

document.body.innerText = "This test verifies WebKit doesn't crash even if the DOM changes in shadow DOM caused the shadow host's style to change.\nPASS";

</script>
</body>
</html>