chromium/src/third_party/blink/web_tests/fast/replaced/render-inline-cast-to-render-box-crash.html - manifest_repos/chromium_src - Git at Google

 <!DOCTYPE html>
 <html>
 <script>
 if (window.testRunner)
     testRunner.dumpAsText();
 </script>
 <style>
 span {
     position: relative;
     height:100px;
 }
 img {
     position: absolute;
     height: 50%;
 }
 </style>
 <body>
 <span>
  <img />
 </span>
 PASS. WebKit didn't crash.
 </body>
 </html>
	<!DOCTYPE html>
	<html>
	<script>
	if (window.testRunner)
	testRunner.dumpAsText();
	</script>
	<style>
	span {
	position: relative;
	height:100px;
	}
	img {
	position: absolute;
	height: 50%;
	}
	</style>
	<body>
	<span>
	<img />
	</span>
	PASS. WebKit didn't crash.
	</body>
	</html>