third_party/WebKit/LayoutTests/fast/replaced/keygen-as-table-column-group-crash.html - chromium/src - Git at Google

 <!DOCTYPE html>
 <script>
     if (window.testRunner)
         testRunner.dumpAsText();
 </script>
 <div style="display:table;">
     <keygen style="display:table-column-group;"></keygen>
     PASS if no crash or assert.
 </div>
	<!DOCTYPE html>
	<script>
	if (window.testRunner)
	testRunner.dumpAsText();
	</script>
	<div style="display:table;">
	<keygen style="display:table-column-group;"></keygen>
	PASS if no crash or assert.
	</div>