chromium/third_party/blink/web_tests/transitions/transition-transform-translate-calculated-length-crash.html

<!DOCTYPE html>
<style>
    div {
        -webkit-transition: transform 50ms;
    }
    #div2 {
        transform: translate(calc(10% + 10px));
    }
</style>
<body>
    <p>Bug <a href="https://crbug.com/261474">http://crbug.com/261474</a>: Dereference null pointer crash in Length::decrementCalculatedRef()</p>
    <p>The test passes if it does not crash.</p>
    <div id="div1"></div>
    <div id="div2"></div>
</body>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();

    document.getElementById("div1").style.transform = "translate(calc(10% + 20px))";
    document.getElementById("div2").style.transform = "none";
</script>