Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/fast/block/float/float-not-removed-crash.html 

<html>
    Test passes if it does not crash.
    <body onload="runTest()">
        <div style="display: -webkit-inline-box">
            <span id="span1">
                <span><blockquote></blockquote></span>
                <span><p style="float: left;"></p></span>
            </span>
            <span id="span2" style="display: list-item"></span>
        </div>
        <script type="text/javascript">
            if (window.testRunner)
                testRunner.dumpAsText();

            function runTest() {
                document.body.offsetTop;
                span1 = document.getElementById('span1');
                span2 = document.getElementById('span2');
                tfoot = document.createElement('tfoot');
                span2.appendChild(tfoot);
                document.body.offsetTop;
                span1.parentNode.removeChild(span1);
            }
        </script>
    </body>
</html>