crash-bad-child-table-continuation.html

<!DOCTYPE html>
<script>
function crash() {
    document.body.style.display = 'inline';

    colgroup=document.createElement('colgroup');
    document.body.appendChild(colgroup)

    document.execCommand('FormatBlock', '');

    pre=document.createElement('pre');
    colgroup.parentNode.insertBefore(pre, colgroup);
    if (window.testRunner)
        testRunner.dumpAsText()
}
window.addEventListener("load", crash, false);
</script>
<p>This test passes if it doesn't crash.</p>

chromium/third_party/blink/web_tests/fast/table/crash-bad-child-table-continuation.html