Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/external/wpt/css/css-tables/crashtests/dynamic_table_layout_crash.html 

<!DOCTYPE html>
<table id="target" style="border: solid; border-collapse: collapse; table-layout: fixed; width: 50px;">
  <tr><td style="background: lime;">hi</td></tr>
  <td colspan=3>there</td>
</table>
<script>
document.body.offsetTop;
document.getElementById('target').style.tableLayout = 'auto';
</script>