Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/fast/block/line-layout/line-break-obj-removal-crash.html 

<!DOCTYPE html>
<html>
<style>
.style1:nth-last-child(odd) { padding-right: 100px; }
.styleCounterBefore:before { position: absolute; content: counter(section); }
</style>
<script>
window.onload = function() {
    divElem = document.createElement('div');
    divElem.setAttribute('class', 'styleCounterBefore');
    document.documentElement.appendChild(divElem);
    brElem = document.createElement('br');
    document.documentElement.appendChild(brElem);
    sampElem = document.createElement('samp');
    sampElem.setAttribute('class', 'style1');
    document.documentElement.appendChild(sampElem);
    spanElem = document.createElement('span');
    spanElem.setAttribute('class', 'styleCounterBefore');
    trElem = document.createElement('tr');
    document.documentElement.appendChild(trElem);
    sampElem.appendChild(spanElem);
    document.documentElement.offsetHeight;
    document.documentElement.removeChild(trElem);

    document.documentElement.appendChild(document.createTextNode('PASS, if no crash or assert in debug'));

    if (window.testRunner)
        testRunner.dumpAsText();
}
</script>
</html>