chromium/third_party/blink/web_tests/fast/css/input-search-table-column-crash.html

<html>
    <script>
        if (window.testRunner)
            testRunner.dumpAsText();
    </script>
    <style>
        input[type="search"]::-webkit-search-cancel-button {
            -webkit-appearance: none; 
            display: table-column;
        }
    </style>
    <input type="search">
    PASS
</html>