chromium/third_party/blink/web_tests/fast/table/resources/recalc-section-first-body-crash.html

<html>
    <body onload="runTest();">
        <junk>a</junk>
        <junk>a</junk>
        <junk id="test1" style="display: -webkit-box; visibility: collapse;">
            <iframe>a</iframe><junk style="display: table-row-group;">a</junk>
        </junk>
        <div>a</div><junk></junk>
        <div id="test2" style="display: table-cell;"></div>

        <script type="text/javascript">
            function reference(domNode)
            {
                this.domNode = domNode;
            }

            function walk(arr, currentPrefix, index, domNode)
            {
                if (domNode == null)
                    return;
                newPrefix = currentPrefix + "_" + index;
                walk(arr, currentPrefix, index + 1, domNode.nextSibling);
                walk(arr, newPrefix, 0, domNode.firstChild);
                arr[newPrefix] = new reference(domNode);
            }

            function removeAll()
            {
                var arr = new Array();
                walk(arr, "", 0, document.body);
                for (key in arr) {
                    arr[key].domNode.parentNode.removeChild(arr[key].domNode);
                    if (document.body)
                        document.body.offsetTop;
                }
            }

            function runTest()
            {
                var test1 = document.getElementById('test1');
                test1.parentNode.removeChild(test1);
                var test2 = document.getElementById('test2');
                test2.appendChild(test1);
                removeAll();
            }
        </script>
    </body>
</html>