Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/fast/table/table-caption-moved-crash.html 

<!DOCTYPE html>
<style>
.c15:nth-last-of-type(-n+6) { display: table; }
</style>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function crash() {
    span = document.createElement('span');
    document.documentElement.appendChild(span);
    quote = document.createElement('q');
    quote.setAttribute('class', 'c15');
    document.documentElement.appendChild(quote);
    caption = document.createElement('caption');
    quote.appendChild(caption);
    span.offsetTop;
    span.appendChild(caption);
    span.offsetTop;
    span.innerHTML = "<a href='https://bugs.webkit.org/show_bug.cgi?id=95090'>Bug 95090</a>: Crash in LayoutTable::removeCaption<br/>This test PASSED as it did not crash.";
}
window.onload = crash;
</script>