add-remove-float-after-table-relayout-crash.html

<!DOCTYPE html>
<style>body { overflow:scroll; }</style>
<p>PASS if no crash or DCHECK failure</p>
<div id="container" style="width:300px;">
  <div style="display:table;"></div>
  <div id="firstFloat" style="float:left;"></div>
  <div id="secondFloat" style="display:none; float:left;"></div>
</div>
<script src="../../../resources/testharness.js"></script>
<script src="../../../resources/testharnessreport.js"></script>
<script>
  test(() => {
    document.body.offsetTop;
    container.style.width = "301px";
    document.body.offsetTop;
    secondFloat.style.display = "block";
    document.body.offsetTop;
    secondFloat.style.display = "none";
  }, "PASS if no crash or DCHECK failure");
</script>

chromium/third_party/blink/web_tests/fast/block/float/add-remove-float-after-table-relayout-crash.html