table-section-node-at-point-crash.html

<!DOCTYPE html>
<html>
<body>
Test passes if it does not crash.
<style>
#test1 {
    display: table-cell;
    content: counter(c);
    counter-reset: c;
    width: 1000px;
    height: 1000px;
}
#test1::after {
    content: counter(c);
    counter-reset: c;
}
#test2 {
    -webkit-flow-into: a;
}
#test2::before {
    content: counter(c);
    counter-reset: c;
}
</style>
<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}

function crash() {
    test1 = document.createElement('div');
    test1.setAttribute('id', 'test1');
    document.body.appendChild(test1);
    test2 = document.createElement('div'); 
    test2.setAttribute('id', 'test2');
    test1.appendChild(test2);
    document.body.offsetTop;
    document.body.style.zoom = 2;
	if (window.testRunner) {
	    GCController.collect();
        eventSender.mouseMoveTo(500, 500);
        testRunner.notifyDone();
	}
}
window.onload = crash;
</script>
</body>
</html>

chromium/third_party/blink/web_tests/fast/table/table-section-node-at-point-crash.html