chromium/third_party/blink/web_tests/fast/text-autosizing/subtree-layout-crash.html

<!DOCTYPE html>
<html>
<head>
<style>

#subtree {
    width: 100px;
    height: 100px;
    overflow: hidden;
    display: list-item;
}

</style>
<script src="resources/autosizingTest.js"></script>
</head>
<body>
Test for crbug.com/360171: this test passes if it does not crash.<br/>
<div id="subtree"></div>

<script>
if (window.testRunner)
    testRunner.waitUntilDone();

window.requestAnimationFrame(function () {
    document.querySelector('#subtree').innerHTML =
        "This text appears inside a relayout boundary.";

    if (window.testRunner) {
        testRunner.dumpAsText();
        testRunner.notifyDone();
    }
});

</script>
</body>
</html>