auto-table-layout-colgroup-removal-crash.html

<!DOCTYPE html>
<p>Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=88676">88676</a>: Crash in TableLayoutAlgorithmFixed::layout</p>
<p id="console">FAILED, the test didn't run.</p>
<table id="table">
    <tbody>
        <tr></tr>
    </tbody>
    <colgroup id="colGroup"></colgroup>
</table>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();

    document.body.offsetTop;
    table.removeChild(colGroup);
    document.getElementById("console").innerHTML = "PASSED, the test didn't crash.";
</script>

chromium/third_party/blink/web_tests/fast/table/auto-table-layout-colgroup-removal-crash.html