chromium/third_party/blink/web_tests/fast/block/float/float-not-removed-from-next-sibling-crash.html

<html>
    <body onload="runTest()">
        Test passes if it does not crash.
        <div style="width: 15px;">
            <script>
                if (window.testRunner)
                    testRunner.dumpAsText();

                function runTest()
                {
                    document.body.offsetTop;
                    var container = document.getElementById('panel');
                    container.style.position = 'relative';
                    document.getElementById('test1').style.position = 'absolute';
                    document.getElementById('test2').style.position = 'absolute';
                    document.body.offsetTop;
                    
                    container.style.height = '1px';
                    document.getElementById('test1').style.display = 'none';
                }
            </script>
            <div id="panel">
                <div id="test1">
                    <img style="float: left" height="1px">
                </div>
                <div id="test2">
                    <a><p>P A S S</p>
                </div>
            </div>
        </div>
    </body>
</html>