<!DOCTYPE html>
<html>
<head>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();

    function crash() {
        var firstBody = document.getElementById("firstBody");
        firstBody.removeChild(firstBody.firstChild);
        firstBody.offsetTop;
    }

    window.addEventListener("load", crash, false);
</script>
</head>
<body>
<p>Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=71246">71246</a>: REGRESSION(98738): Multiple crashes in the table rendering code</p>
<p>This test PASSES if it does not CRASH.</p>
<table style="border-collapse: collapse">
    <tbody id="firstBody" style="border: 2px solid green"><tr style="border: 4px solid red"></tr></tbody>
</table>
</body>
</html>