chromium/third_party/blink/web_tests/shadow-dom/crashes/character-data-set-data-crash.html

<!DOCTYPE html>
<script src='../../resources/testharness.js'></script>
<script src='../../resources/testharnessreport.js'></script>
<div id="host">XXX</div>
<script>
test(() => {
  document.body.offsetTop;
  var root = host.attachShadow({mode:"open"});
  root.innerHTML = "<slot></slot>";
  host.firstChild.data = " ";
  assert_true(true, 'This test must run without crash.');
}, 'Setting CharacterData.data while distribution is dirty should not cause a crash (crbug.com/673967).' );
</script>