merge-anonymous-block-remove-child-crash.html

<html>
<body onload="runTest();">
<span style="display: run-in" id="runIn">
</span>
<span style="display: list-item" id="listItem">
</span>
<div id="result"></div>
<script>
if (window.testRunner)
{
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}

function runTest()
{
    document.body.offsetTop;
    var runIn = document.getElementById('runIn');
    var listItem = document.getElementById('listItem');

    runIn.appendChild(document.createElement('menu'));
    
    ol = document.createElement('ol');
    listItem.appendChild(ol);
    listItem.appendChild(document.createElement('i'));
    
    document.body.offsetTop;
    listItem.removeChild(ol);
    document.body.removeChild(runIn);
    document.body.removeChild(listItem);

    document.getElementById('result').innerHTML = "PASS";
    if (window.testRunner)
        testRunner.notifyDone();
}
</script>
</body>
</html>

chromium/third_party/blink/web_tests/fast/block/merge-anonymous-block-remove-child-crash.html