render-inline-cast-to-render-box-crash.html

<!DOCTYPE html>
<html>
<script>
if (window.testRunner)
    testRunner.dumpAsText();
</script>
<style>
span {
    position: relative;
    height:100px;
}
img {
    position: absolute;
    height: 50%;
}
</style>
<body>
<span>
 <img />
</span>
PASS. WebKit didn't crash.
</body>
</html>

chromium/third_party/blink/web_tests/fast/replaced/render-inline-cast-to-render-box-crash.html