chromium/third_party/blink/web_tests/accessibility/contenteditable-table-check-causes-crash.html

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../resources/js-test.js"></script>
</head>
<body>

<script>
  description("Ensures that this snippet does not lead to a crash in the code that detects if a table is contenteditable. Bug 87409.");
</script>

<style>
.tableStyle { display: inline-table; content: counter(section);</style>
<script>
function crash() {
  var node = document.createElement('keygen');
  node.setAttribute('autofocus', 'autofocus');
  node.setAttribute('class', 'tableStyle');
  document.documentElement.appendChild(node);
}
window.onload = crash;
</script>

<p id="description"></p>
<div id="console"></div>

</body>
</html>