Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/external/wpt/css/css-conditional/container-queries/crashtests/dirty-rowgroup-crash.html 

<!DOCTYPE html>
<div style='container-type: size;'></div>
<table>
  <tbody id='id_0'></tbody>
    <th id='id_1'>
      <tr>
        <th></th>
      </tr>
    </th>
</table>
<script>
  const tbody = document.getElementById('id_0')
  tbody.getBoundingClientRect();
  const theader = document.getElementById('id_1')
  tbody.outerText = 'foo';
  theader.setAttribute('rowspan', 100)
  tbody.getBoundingClientRect();
</script>