third_party/blink/web_tests/web-components-v0-only/slotted-pseudo-element-in-v0-tree-crash.html - chromium/src - Git at Google

 <!DOCTYPE html>
 <script>
     if (window.testRunner)
         testRunner.dumpAsText();
 </script>
 <p>PASS if no crash.</p>
 <div id="host">
     <div id="inner"></div>
 </div>
 <script>
 var root = host.attachShadow({mode: 'open'});
 root.innerHTML = '<style>::slotted(*) { color: green }</style>';
 getComputedStyle(inner).color;
 </script>
	<!DOCTYPE html>
	<script>
	if (window.testRunner)
	testRunner.dumpAsText();
	</script>
	<p>PASS if no crash.</p>
	<div id="host">
	<div id="inner"></div>
	</div>
	<script>
	var root = host.attachShadow({mode: 'open'});
	root.innerHTML = '<style>::slotted(*) { color: green }</style>';
	getComputedStyle(inner).color;
	</script>