chromium/third_party/blink/web_tests/css3/flexbox/anonymous-block-merge-crash.html

<div style="display:flex;"><div id="inner"></div>If this page doesn't crash then this test passes.</div>
<script>
if (window.testRunner)
    testRunner.dumpAsText()
var inner = document.getElementById("inner");
inner.parentNode.removeChild(inner);
</script>