If we force full tree walk by removing the early return from PrePaintTreeWalk::walk(), the following tests will crash:

compositing/geometry/preserve-3d-switching.html
compositing/preserve-3d-toggle.html

Stderr output:
[1:1:0315/111053.734512:1985090719791:FATAL:FindPropertiesNeedingUpdate.h(142)] Check failed: *m_originalProperties->transform() == *objectProperties->transform(). Property was updated without the layout object ("LayoutBlockFlow (positioned) DIV") needing a paint property update.
Original:
parent=0x1d557a69c10 transform=translation(0,0,50), scale(1,1,1), skew(0,-5.55112e-17,0), quaternion(0,0.34202,0,0.939693), perspective(0,0,0,1) origin=100,100,0 flattensInheritedTransform=no renderingContextId=48c1d087 directCompositingReasons=transform3D compositorElementId=(0, 0)
Updated:
parent=0x1d557a69c10 transform=translation(0,0,50), scale(1,1,1), skew(0,-5.55112e-17,0), quaternion(0,0.34202,0,0.939693), perspective(0,0,0,1) origin=100,100,0 flattensInheritedTransform=yes renderingContextId=0 directCompositingReasons=transform3D compositorElementId=(0, 0)
#0 0x7f9f2a88154b base::debug::StackTrace::StackTrace()
#1 0x7f9f2a87fbdc base::debug::StackTrace::StackTrace()
#2 0x7f9f2a8ee0cf logging::LogMessage::~LogMessage()
#3 0x7f9f2152c1ac blink::FindObjectPropertiesNeedingUpdateScope::~FindObjectPropertiesNeedingUpdateScope()
#4 0x7f9f21526c30 blink::PaintPropertyTreeBuilder::updatePropertiesForSelf()
#5 0x7f9f2154d52b blink::PrePaintTreeWalk::walk()
#6 0x7f9f2154d622 blink::PrePaintTreeWalk::walk()
#7 0x7f9f2154d622 blink::PrePaintTreeWalk::walk()
#8 0x7f9f2154d622 blink::PrePaintTreeWalk::walk()
#9 0x7f9f2154d622 blink::PrePaintTreeWalk::walk()
#10 0x7f9f2154d622 blink::PrePaintTreeWalk::walk()
#11 0x7f9f2154d32e blink::PrePaintTreeWalk::walk()
#12 0x7f9f2154d119 blink::PrePaintTreeWalk::walk()
#13 0x7f9f20b9addb blink::FrameView::prePaint()
#14 0x7f9f20b99785 blink::FrameView::updateLifecyclePhasesInternal()