caption-min-greater-than-max-crash.html

<!DOCTYPE html>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>

<div style="width:fit-content">
  <!-- To use just one tag, it has to be display:table-caption instead of <caption>
    to reproduce. I suppose the parser's fix-up algorithm is different than Layout's.
    Parser turns <caption> into a normal BlockFlow. Layout surrounds this with a table.
  -->
  <div style="display:table-caption">some content</div>
</div>

<script>
  test(() => {
  }, "No crash or assertion failure. crbug.com/857185");
</script>

chromium/third_party/blink/web_tests/fast/table/caption-min-greater-than-max-crash.html