Also happens on Linux. https://ci.chromium.org/p/chromium/builders/luci.chromium.ci/Linux%20Tests%20%28dbg%29%281%29/74587

https://chromium-review.googlesource.com/c/chromium/src/+/1238728 appears to be responsible (verified locally).

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e092f9c13e351034e12388bbb8bd77d922b616e8

commit e092f9c13e351034e12388bbb8bd77d922b616e8
Author: Jeremy Roman <jbroman@chromium.org>
Date: Mon Sep 24 17:50:10 2018

Revert "Workaround for nested remove for datalists."

This reverts commit f76237333778b789b112dfb693a55631a69020bd.

Reason for revert: causes DCHECK failures in external/wpt/html/semantics/embedded-content/media-elements/track/track-element/track-mode-disabled.html

Original change's description:
> Workaround for nested remove for datalists.
> 
> Nested removes confuses the style traversal roots. Make this a general
> workaround for UA shadow removals.
> 
> Bug:  888236 , 888448
> Change-Id: Ia0165e7478c96282900a8191eeac18ae34586a2c
> Reviewed-on: https://chromium-review.googlesource.com/1238728
> Reviewed-by: Anders Ruud <andruud@chromium.org>
> Commit-Queue: Rune Lillesveen <futhark@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#593510}

TBR=futhark@chromium.org,andruud@chromium.org

Change-Id: I843b4cc5d9be74fea13ff43305b0093fd64dcae3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug:  888236 , 888448,  888618 
Reviewed-on: https://chromium-review.googlesource.com/1240505
Reviewed-by: Jeremy Roman <jbroman@chromium.org>
Commit-Queue: Jeremy Roman <jbroman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#593592}
[delete] https://crrev.com/a3d55f3d90dab08b9370ee62889525f494e52298/third_party/WebKit/LayoutTests/fast/css/style-traversal-root-datalist-crash.html
[modify] https://crrev.com/e092f9c13e351034e12388bbb8bd77d922b616e8/third_party/blink/renderer/core/css/style_engine.cc

Reopened  issue 888236  instead.

Issue 888902 has been merged into this issue.