chromium/third_party/blink/web_tests/fast/deprecated-flexbox/layoutHorizontalBox-crash.html

<style>
.c6:first-letter { visibility: hidden; }
.c6:nth-last-child(2n+10000000000000000) { text-align: -webkit-center; width: 10px; }
.c26:first-letter { visibility: inherit; overflow: scroll; float: left;</style>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function runTest() {
    var button = document.createElement('button');
    button.setAttribute('class', 'c6');
    document.documentElement.appendChild(button);
    document.documentElement.appendChild(document.createElement('dfn'));
    var figCaption = document.createElement('figcaption');
    figCaption.setAttribute('class', 'c26');
    document.documentElement.appendChild(document.createElement('var'));
    document.documentElement.appendChild(document.createElement('summary'));
    var text = document.createTextNode("bug 70183: Crash in LayoutDeprecatedFlexibleBox::layoutHorizontalBox");
    figCaption.appendChild(text);
    button.appendChild(figCaption);
    document.body.offsetTop;
    document.documentElement.appendChild(document.createTextNode("If this test did not CRASH or show errors in valgrind, it has PASSED."));
}
window.onload = runTest;
</script>