chromium/third_party/blink/web_tests/fast/forms/interactive-validation-select-crash.html

<!DOCTYPE html>
<head>
<script src="../../resources/js-test.js"></script>
</head>
<body>
<p>Test for a bug that LayoutBlockFlow crashed when a validation message bubble for a select element with float:left was closing.</p>
<div id=console></div>
<form>
<select style="float:left" required>
<option value="">Plese select</option>
<option>Foo</option>
</select>
<input type=submit id=submit>
</form>

<script>
window.jsTestIsAsync = true;

function closeBubble() {
    // Make the <select> valid to close the validation message bubble.
    document.getElementsByTagName('select')[0].selectedIndex = 1;
    setTimeout(finish, 0);
}
function finish() {
    testPassed('Not crashed.');
    finishJSTest();
}

document.getElementById('submit').click();
setTimeout(closeBubble, 0);
</script>
</body>