third_party/WebKit/LayoutTests/fast/table/crash-section-logical-height-changed-needsCellRecalc.html

<style>
.c3 { position: fixed; }
.c12:first-letter { visibility: inherit; }
.c12 { -webkit-appearance: button; }
.c13 { display: table-row; }
.c13:nth-last-child(odd) { height: 80%; }
</style>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function boom() {
    var quote = document.createElement('q');
    document.documentElement.appendChild(quote);

    base = document.createElement('base');
    base2 = document.createElement('base');
    base2.setAttribute('class', 'c3');
    quote.appendChild(base2);

    var ins = document.createElement('ins');
    base2.appendChild(ins);

    var sub = document.createElement('sub');
    var quote3 = document.createElement('q');
    quote3.setAttribute('class', 'c12');
    sub.appendChild(quote3);

    figureRow = document.createElement('figure');
    figureRow.setAttribute('class', 'c13');
    document.documentElement.appendChild(figureRow);

    var col = document.createElement('col');
    col.setAttribute('class', 'c13');
    document.documentElement.appendChild(col);

    var select = document.createElement('select');
    document.documentElement.appendChild(select);

    code = document.createElement('code');
    document.documentElement.appendChild(code);

    quote2 = document.createElement('q');
    setTimeout('quote2.appendChild(code);', 321);
    ins.appendChild(sub);
    setTimeout('base.appendChild(figureRow);', 251);
    text = document.createTextNode('-1435037881');
    setTimeout('figureRow.appendChild(text);', 206);
}
window.onload = boom;
</script>
<p>Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=76842">76842</a>: Crash in WebCore::LayoutTableSection::rowLogicalHeightChanged</p>
<p>This test passes if it does not crash nor ASSERT.</p>