chromium/third_party/blink/web_tests/fast/deprecated-flexbox/order-iterator-crash.html

<div>This test has passed if it doesn't crash under ASAN.</div>
<style>
* { display: flex; }
</style>
<table><td id="crashy"></td></table>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

crashy.offsetLeft;
crashy.parentNode.removeChild(crashy);
</script>