chromium/third_party/blink/web_tests/fast/table/split-table-section-before-anonymous-block-crash.html

<!DOCTYPE html>
<p>PASS if no crash or assertion failure.</p>
<div style="display:table-row-group;">
    <div></div>
    <div id="splitter" style="display:none;"></div>
    <div style="display:inline-block; width:75px; height:50%; background:blue;"></div>
</div>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();
    document.body.offsetTop;
    document.getElementById("splitter").style.display = "table-row";
</script>