chromium/third_party/blink/web_tests/fast/block/percent-height-descendant-not-removed-crash.html

<html>
    <head>
        <script>
            if (window.testRunner)
                testRunner.dumpAsText();
             
            function runTest()
            {
                test1 = document.getElementById('test1');
                test2 = document.getElementById('test2');
                test3 = document.getElementById('test3');

                document.body.offsetTop;    
                test1.removeChild(test2);
                test1.removeChild(test3);
            }
        </script>
    </head>
    <body onload="runTest();">
        Test passes if it does not crash.
        <div id="test1" style="-webkit-writing-mode: vertical-rl;">
            <div id="test2"></div>
            <div id="test3" style="width: 100%"></div>
        </div>
    </body>
</html>