chromium/third_party/blink/web_tests/fast/inline/update-always-create-line-boxes-full-layout-crash.html

<!DOCTYPE HTML>
<html>
<style>
.table:nth-last-child(even) { line-height: 100%; }
</style>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function runTest()
{
    var test = document.getElementById('test');
    test.parentNode.removeChild(test);
}

window.onload = runTest; 
</script>
<table class=table>
<td><rt>PASS</rt></junk></td>
<table><span id="test"></table>
</table>
</html>