chromium/third_party/blink/web_tests/shadow-dom/crashes/slots-in-document-tree-crash.html

<!DOCTYPE html>
<script src='../../resources/testharness.js'></script>
<script src='../../resources/testharnessreport.js'></script>
<div id='p1'><slot><div id='c1'></div></slot></div>
<script>
test(() => {
  document.body.offsetLeft;
  const doc = document.implementation.createDocument("http://www.w3.org/1999/xhtml", "html");
  doc.adoptNode(c1);
  p1.style.display = "none";
}, "Slots in a document tree should not cause a crash.");
</script>