chromium/third_party/blink/web_tests/fast/table/before-child-non-table-section-add-table-crash.html

<html>
    <body onload="runTest();">
        <div id="table" style="display: table;">
            <em id="em"></em>
            <audio controls="arbitrary" style="display: table-caption;" />
            <img id="img" />
        </div>
        <div id="result"></div>
        <script type="text/javascript">
            if (window.testRunner)
                testRunner.dumpAsText();

            function runTest()
            {
                var img = document.getElementById('img');
                var em = document.getElementById('em');
                em.parentNode.replaceChild(img, em);
                document.body.offsetTop;
                document.body.removeChild(document.getElementById('table'));
                
                document.getElementById("result").innerHTML = "PASS";
            }
        </script>
    </body>
</html>