intruding-float-not-removed-from-next-sibling-crash.html

<html>
<head>
<style>
#float1 {
    float: left; 
}
#div1 {
    display: table;
    padding-top: 1em;
    padding-bottom: 1em;
    margin-bottom: 1em;
    margin-block-start: -100px; 
}
</style>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

onload = function() {
document.body.appendChild(document.createElement('select'));

float1 = document.createElement('hr');
float1.setAttribute('id', 'float1');
document.body.appendChild(float1);

div1 = document.createElement('div');
div1.setAttribute('id', 'div1');
document.body.appendChild(div1);
div1.appendChild(document.createElement('textarea'));

div2 = document.createElement('div');
document.body.appendChild(div2);
div2.appendChild(document.createElement('input'));

document.body.offsetTop;
document.body.removeChild(float1);
document.body.offsetTop;
document.body.innerHTML = "PASS. WebKit didn't crash.";
}
</script>
</head>
<body>
</body>
</html>

chromium/third_party/blink/web_tests/fast/block/float/intruding-float-not-removed-from-next-sibling-crash.html