chromium/third_party/blink/web_tests/fast/css/layerZOrderCrash.html

<html>
<head>
<style type="text/css">
html, table {
position: relative;
}
</style>
</head>

<body>

To reproduce this bug outside of DumpRenderTree, click the link below. If broken,
we will crash. <br>

<script>
function disappear() {
    var e = document.getElementById('foo');
    
    if(e.style.display !='none') 
        e.style.display='none'; 
    else 
        e.style.display=''; 
    
    return false;
}
</script>

<table>
<tr><td><a href="#" onclick="disappear()">link</a></td></tr>
<tr id="foo" style="">
    <td>
    <table>
        <tr><td>content<br>content<br>content<br></td></tr>
    </table>
    </td>
</tr>
</table>

<script>
    if (window.eventSender) {
        eventSender.mouseMoveTo(30,20);
        eventSender.mouseDown();
        eventSender.mouseUp();
    }
</script>

</body>
</html>