chromium/third_party/blink/web_tests/fast/lists/dynamic-marker-crash.html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
     "http://www.w3.org/TR/html4/strict.dtd">
<html>
	<head>
		<title>Test</title>
		<script type="text/javascript">
			function displayOnOff(el)
			{
		  		el.style.display = (el.style.display == 'block') ? 'none' : 'block';
			}
		</script>
	</head>
	<body>
		
	<!-- Removing the <ul> and <li> elements will make this work in Safari! -->
	<ul>
	  <li> 
		<form action="./" id="myform" method="get" style="display:none">
			<p><input id="tag_list" name="tag_list"	size="40" type="text" value="blah blubb" >
			</p>
		</form>
		<p>There should be an input field above this line of text.</a></p>
	  </li>
	</ul>
<script>
document.body.offsetLeft
displayOnOff(document.getElementById('myform'))
document.body.offsetLeft
</script>
	</body>
</html>