chromium/third_party/blink/web_tests/fast/table/change-tbody-border-width-crash.html

<!doctype html>
<script src="../../resources/run-after-layout-and-paint.js"></script>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();

    runAfterLayoutAndPaint(
        function () {
            theTbody.removeChild(row1);
            theTbody.style.border = "solid 10px blue";
        }, true /* autoNotifyDone */);
</script>
<table style="border-collapse: collapse">
    <tbody id=theTbody>
        <tr id=row1><td>Some text</td></tr>
    </tbody>
</table>
<p>There was a crash when a row was removed and the border of a section was changed without an intervening CellRecalc.</p>
<p>No crash == pass</p>