chromium/third_party/blink/web_tests/shadow-dom/crashes/slot-nested-reattach-crash.html

<!DOCTYPE html>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<div id="host">
  <div>
    <div id="inner"></div>
  </div>
</div>
<script>
  const root = host.attachShadow({mode:"open"});
  root.innerHTML = "<slot></slot>";

  test(() => {
    host.offsetTop;
    host.style.display = "inline";
    inner.style.display = "inline";
    host.offsetTop;
  }, "This test should not leave the tree dirty, causing DCHECK failures.");
</script>