chromium/third_party/blink/web_tests/fast/table/display-table-caption-crash.html

<!DOCTYPE html>
<style>
.caption:after {
  position:absolute;
  content: counter(c, lower-armenian) attr(id);
  counter-increment: c 895;
}
.caption { -webkit-transform:skew(20deg); }
.caption:last-of-type { display: table-caption; }
.option:nth-of-type(2n+1) { counter-increment: c 578; }
</style>

This test passes if it does not CRASH.
<option>

<script>
if (window.testRunner)
  testRunner.dumpAsText();

onload = function() {
  var el = document.createElement('li');
  el.setAttribute('class', 'caption');
  document.body.appendChild(el);

  document.body.offsetTop;

  var o = document.querySelector('option');
  o.setAttribute('class', 'option');
}
</script>