negative-remaining-length-crash.html

<html>
<head>
    <title></title>
    <script type="text/javascript">
        if (window.testRunner)
            testRunner.dumpAsText();
    </script>
</head>
<frameset cols="6,*">
    <frame src="data:text/html,
        <frameset cols='*,*,50%'>
            <frame>
            <frame>
            <frame>
        </frameset>
    ">
    <frame src='data:text/html,
        <p>
        Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=12082">Test for http://bugs.webkit.org/show_bug.cgi?id=12082</a>
        REGRESSION (r18333): Crash in LayoutFrameSet::layOutAxis()</i>.
        </p>
        <p>
        On an Intel machine, no crash means SUCCESS.
        </p>
    '>
</frameset>
</html>

chromium/third_party/blink/web_tests/fast/frames/negative-remaining-length-crash.html