fast/table/crash-empty-section-fixed-layout-calcArray.html

<!DOCTYPE html>
<html>
<head>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();

    function crash() {
        var firstBody = document.getElementById("firstBody");
        firstBody.removeChild(firstBody.firstChild);
        firstBody.offsetTop;
    }

    window.addEventListener("load", crash, false);
</script>
</head>
<body>
<p>Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=71246">71246</a>: REGRESSION(98738): Multiple crashes in the table rendering code</p>
<p>This test PASSES if it does not CRASH.</p>
<table style="table-layout:fixed; width:0;">
    <tbody id="firstBody"><tr></tr></tbody>
</table>
</body>
</html>