chromium/third_party/blink/web_tests/compositing/overflow/escape-clip-to-scroll-sibling-should-not-crash.html

<!DOCTYPE html>
<div style="overflow:scroll; position:relative; width:100px; height:100px;">
  <div id="elem" style="position:relative; width:200px; height:200px; overflow:hidden;">
    <div style="will-change:opacity; overflow:hidden; width:10px; height:10px;">
      <div style="position:absolute; width:250px; height:250px; background:green;"></div>
    </div>
  </div>
</div>
This test verifies an element can correctly escape clip to some scroll sibling's state.
<script src="../../resources/run-after-layout-and-paint.js"></script>
<script>
// The crash we intended to test is sensitive to random hash ordering.
// There is a 50% probability to crash for each trial.
var elem = document.getElementById('elem');
var count = 10;
function toggle() {
  if (elem.style.display == 'none')
    elem.style.display = '';
  else
    elem.style.display = 'none';

  if (--count)
    runAfterLayoutAndPaint(toggle);
  else if (window.testRunner)
    testRunner.notifyDone();
}
if (window.testRunner)
  testRunner.waitUntilDone();
runAfterLayoutAndPaint(toggle);
</script>