chromium/third_party/blink/web_tests/shadow-dom/crashes/slot-dir-attribute-crash.html

<!DOCTYPE html>
<script src='../../resources/testharness.js'></script>
<script src='../../resources/testharnessreport.js'></script>
<script>
test(() => {
  let slot = document.createElement("slot");
  // This could cause crash. See crbug.com/627385
  slot.setAttribute("dir", "auto");
  assert_true(true, 'This test must run without crash.');
}, "HTMLSlotElement's dir attribute should not be used until Blink supports slots in a flat tree.");
</script>