third_party/WebKit/LayoutTests/fast/dom/HTMLMeterElement/meter-element-crash.html

<!-- Test for Bug 50026. PASS unless crash. -->
<style>
 meter {
   -webkit-appearance: none;
 }  
</style>
<span id="test">
    <script>
    document.body.offsetTop;
    </script>
    <input type="text">
    <meter>
    </meter>
</span>
<script>
    if (window.testRunner) {
        testRunner.dumpAsText();
        testRunner.waitUntilDone();
    }
    setTimeout(function() {
        document.body.offsetTop;
        document.getElementById('test').innerHTML="PASS";
        if (window.testRunner)
            testRunner.notifyDone();
    }, 0);
</script>