chromium/third_party/blink/web_tests/fast/block/positioning/abspositioned-object-under-split-relpositioned-inline-crash.html

<!DOCTYPE html>
<html>
<body>
<style>
.class1 { position: relative; }
.class2 { position: absolute; }
</style>
<script>
window.onload = function() {
    document.designMode="on";
    document.execCommand("SelectAll");
    document.execCommand("Strikethrough");
    document.body.offsetTop;
    document.body.innerHTML = "PASS. WebKit didn't crash.";

    if (window.testRunner)
        testRunner.dumpAsText();
}
</script>
<i class="class1">
<span class="class2"></span>
<div>
<xmp class="class2">
A
</xmp>
</div>
</i>
</body>
</html>