chromium/third_party/blink/web_tests/fast/layers/layer-status-change-crash.html

<!DOCTYPE HTML>
<body>
<div id="div">This test passes if it does not crash.</div>
<script src="../../resources/run-after-layout-and-paint.js"></script>
<script>
if (window.testRunner) {
  testRunner.waitUntilDone();
  testRunner.dumpAsText();

  var div = document.getElementById('div');
  runAfterLayoutAndPaint(function() {
    div.style.position = 'relative';
    div.style.backgroundColor = 'blue';
    runAfterLayoutAndPaint(function() {
      div.textContent += ' PASS';
      testRunner.notifyDone();
    });
  });
} else {
  document.body.textContent = 'This test needs DumpRenderTree.';
} 
</script>
</body>