chromium/third_party/blink/web_tests/fast/text-autosizing/table-simplified-layout-crash.html

<!DOCTYPE HTML>
<script src="resources/autosizingTest.js"></script>
Test for crbug.com/359387: this test passes if it does not crash.<br/>
<style>
table {
  overflow: hidden;
  width: 200px;
  position: relative;
  height: 100px;
}
</style>
<table>
  <tr>
    <td style="position: absolute;">
      <li id="liEl"/>
    </td>
  </tr>
</table>
<script>
  if (window.testRunner)
    testRunner.waitUntilDone();
  window.requestAnimationFrame(function() {
    liEl.style.overflow = "scroll";
    window.requestAnimationFrame(function() {
      if (window.testRunner) {
        testRunner.dumpAsText();
        testRunner.notifyDone();
      }
    });
  });
</script>