webview-plugin-updates-without-layout.html

<!DOCTYPE html>
<style>
html:first-letter { color: papayawhip; }
</style>
<script>
function boom() {
	if (window.testRunner)
		testRunner.dumpAsText();

	// Trigger a full-document style recalc.
        document.getElementsByTagName("style")[0].disabled = true;
	// Force the style to update without running the rest of the lifecycle.
	document.querySelector("embed").align;
}
</script>
<body onload="boom()">
<embed type="html">
Test passes if no crash.

chromium/third_party/blink/web_tests/fast/plugins/webview-plugin-updates-without-layout.html