chromium/third_party/blink/web_tests/fast/text-autosizing/table-inflation-crash.html

<!DOCTYPE HTML>
<html>
    <meta name="viewport" content="width=800">
    <style>
      body {
        width: 800px;
        margin: 0;
        overflow-y: hidden;
      }
    </style>
    <script src="resources/autosizingTest.js"></script>
    <script>
        window.onload = function() {
            if (window.testRunner)
                testRunner.dumpAsText();
        }
    </script>
    Test for crbug.com/385268:This test passes if it does not crash.<br>
    autosize autosize autosize autosize autosize autosize autosize autosize autosize
    autosize autosize autosize autosize autosize autosize autosize autosize autosize
    autosize autosize autosize autosize autosize autosize autosize autosize autosize
    <object align="left" style="writing-mode: vertical-rl">
        <table align="left">
            <h1>crash</h1>
        </table>
        <li></li>
    </object>
</html>