chromium/third_party/blink/web_tests/fast/deprecated-flexbox/horizontal-box-float-crash.html

<html>
<body onload="runTest()">
<script>
    if (window.testRunner)
        testRunner.dumpAsText();

    function runTest()
    {
        document.body.offsetTop;
        var container = document.getElementById('container');
        var test = document.getElementById('test');
        var blockquote = document.getElementById('blockquote');
        blockquote.parentNode.removeChild(blockquote);
        test.appendChild(blockquote);
        document.body.offsetTop;
        test.parentNode.removeChild(test);
        if (window.testRunner) {
            // Force a focus in which forces a paint that can trigger the crash.
            testRunner.setWindowFocus(false);
            testRunner.setWindowFocus(true);
            document.getElementById("results").innerHTML = "PASS";
        }
    }
</script>
<div>This test passes if it does not crash.</div>
<div id="container" style="display: -webkit-box;">
    <div id="test">
        <span style="float: right;">This is a floating span.</span>
        <span>.</span>
    </div>
    <span>
        <ol id="results">
            <blockquote id="blockquote">blockquote</blockquote>
        </ol>
    </span>
</div>
</body>
</html>