chromium/src/third_party/blink/web_tests/fast/frames/expand-grid-with-zero-size-child-frameset-crash.html

<script>
    if (window.testRunner)
        testRunner.dumpAsText();
    onload = ()=> {
        // Force layout first.
        document.documentElement.offsetTop;

        // Then expand the root frameset grid from 2x1 to 2x2.
        document.getElementById("rootSet").setAttribute("rows", "*, 0");
    }
</script>
<frameset id="rootSet" cols="0, *">
    <frame id="firstChild"></frame>
    <frame src="data:text/html,PASS if no crash or assertion failure."></frame>
    <frameset>
         <frame src="data:text/html,3"></frame>
     </frameset>
</frameset>