chromium/third_party/blink/web_tests/fast/css/containment/change-text-node-data-crash.html

<!DOCTYPE html>
<meta charset="utf-8">
<style>
#test {
  contain: layout size;
  line-height: 1;
}
</style>
<p>The test passes if you see the word "PASS" below and it doesn't crash in debug.</p>
<div id="test">
  <div style="display: inline-block;"></div>
</div>
<script>
  if (window.testRunner)
    testRunner.dumpAsText();

  let contentNode = document.createTextNode("");
  contentNode.data = "FAIL";
  test.appendChild(contentNode);

  document.body.offsetLeft;
  contentNode.data = "PASS";
</script>