Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/second-legend-becomes-rendered-legend-crash.html 

<!DOCTYPE html>
<link rel="author" title="Morten Stenshorne" href="mailto:[email protected]">
<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1119400">
<fieldset>
  <legend id="legend1"></legend>
  <legend id="legend2"><div id="child" style="float:left;"></div></legend>
</fieldset>
<script>
  requestAnimationFrame(()=> {
      requestAnimationFrame(()=> {
          legend1.style.display = "none";
          document.body.offsetTop;

          child.style.width = "22px";
          document.body.offsetTop;

          child.style.display = "none";
      });
  });
</script>