chromium/third_party/blink/web_tests/fast/deprecated-flexbox/overhanging-floats-not-removed-crash.html

<!DOCTYPE html>
<html>
<body>
<style>
#test1 {
    display: -webkit-flexbox;
}
#test1::before {
    content: "A";
}
#test2::before {
    content: "B";
    float: right;
}
</style>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function runTest() {
    document.body.offsetTop;

    test1 = document.createElement('div');
    test1.setAttribute('id', 'test1');
    document.body.appendChild(test1);

    test2 = document.createElement('span'); 
    test2.setAttribute('id', 'test2');
    test1.appendChild(test2);

    test3 = document.createElement('div');
    test1.appendChild(test3);
    test3Child = document.createElement('div');
    test3.appendChild(test3Child);

    document.body.offsetTop;
    test2.style.display = '-webkit-flexbox';
    
    document.body.offsetTop;
    document.body.innerHTML = "PASS";
}

window.onload = runTest;
</script>
</body>
</html>