chromium/third_party/blink/web_tests/fast/table/crash-table-cell-change-height.html

<!DOCTYPE html>
<html>
<body>
<table>
<tr id="row">
<th id="header" height="50">If this test does not crash, it has PASSED.</th>
<th>Bug 72004: Crash in styleDidChange when changing a table cell's height.<br></th>
</tr>
</table>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

var row = document.getElementById("row");
var header = document.getElementById("header");
row.parentNode.appendChild(header);
</script>
<script>
header.setAttribute("height", 1);
</script>
</body>
</html>