chromium/third_party/blink/web_tests/fast/block/float/float-append-child-crash.html

<span id=enclosingInline><span><div style="backround-image: rgba(27, 48); font: 110px/7em sans-serif; zoom: 36717; "> }	 Z bP  v	ed
</h3><span id=inlineToMove><div></div>
x<div style='border-top: dashed; float: left; border: 4058 solid; '></div><div>x</div>
<div><video>

<script>
if (window.testRunner) {
    testRunner.dumpAsText();
}
function crash() {
    enclosingInline.appendChild(inlineToMove);
    document.body.offsetTop;
    document.body.innerHTML = "PASS. Test didn't crash.";
}
document.addEventListener("DOMContentLoaded", crash, false);
</script>