Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/external/wpt/css/css-tables/crashtests/dialog-table-crash.html 

<!DOCTYPE html>
<link rel="help" href="https://crbug.com/1175425">

<div id="container" style="border-collapse:collapse;">
  <div id="insertBefore"></div>
  <div style="display:table-row-group;"></div>
  <div id="victim" style="border:solid; display:table-row-group;">
    <div style="display:table-cell;"></div>
  </div>
</div>

<script>
  document.body.offsetTop;
  container.insertBefore(insertBefore, victim)
</script>