chromium/third_party/blink/web_tests/fast/block/float/float-mark-descendants-for-layout-crash.html

<!doctype HTML>
<script>
if (window.testRunner) {
    testRunner.waitUntilDone();
    testRunner.dumpAsText();
}
</script>
<style>
.c7 { float: right; }
.c8:nth-last-of-type(2n+1) { float: right;}
</style>
<script>
// This test will crash if we leave stale floats in a child's descendants. 
var nodes = Array();
function reference(domNode) {
    this.domNode = domNode;
} 
function walk(a, currentPrefix, index, domNode) {
    if(domNode == null) 
        return; 
    newPrefix = currentPrefix + "_" + index;
    a[newPrefix] = new reference(domNode);
} 
function clear() {
    var a = new Array();
    walk(a, "", 0, document.documentElement);
    for(key in a) {
        a[key].domNode.parentNode.removeChild(a[key].domNode);
    } 
    if (window.testRunner)
        testRunner.notifyDone(); 
}
function boom() {
     nodes[0] = document.createElement('meter');
     nodes[0].setAttribute('class', 'c7');
     document.documentElement.appendChild(nodes[0]);
     nodes[58] = document.createElement('br');
     document.documentElement.appendChild(nodes[58]);
     nodes[63] = document.createElement('h1');
     nodes[63].setAttribute('class', 'c8');
     document.documentElement.appendChild(nodes[63]);
     nodes[66] = document.createElement('iframe');
     nodes[66].setAttribute('srcdoc', '');
     document.documentElement.appendChild(nodes[66]);
     nodes[72] = document.createElement('sup');
     nodes[72].setAttribute('class', 'c7');
     document.documentElement.appendChild(nodes[72]);
    setTimeout('clear();', 700);
}
window.onload = boom;
</script>