chromium/third_party/blink/web_tests/fast/inline/inline-destroy-dirty-lines-crash.html

<html>
<body onload="runTest()">
Test passes it it does not crash.
<script>
    if (window.testRunner)
        testRunner.dumpAsText();

    function runTest()
    {
        document.body.offsetTop;
        child = document.getElementById('test');
        child.parentNode.removeChild(child);
    }
</script>
<br>
<span id="test"></span>
</body>
</html>