chromium/third_party/blink/web_tests/fast/css/remove-fixed-resizer-crash.html

<!DOCTYPE html>
<html>
<head>
<style>
    body {
        height: 2000px;
    }
    
    *::-webkit-resizer { position: fixed; }
</style>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();
    
    function doTest()
    {
        var svgElement = document.createElementNS("http://www.w3.org/2000/svg", "svg");
        document.body.appendChild(svgElement);
        window.scrollBy(0, 100);
    }
    window.addEventListener('load', doTest, false);
</script>
</head>
<body>
    <p>This test should not crash</p>
    <input>
</body>
</html>