LayoutTests/fast/table/table-caption-moved-crash.html - WebKit - Git at Google

 <!DOCTYPE html>
 <style>
 .c15:nth-last-of-type(-n+6) { display: table; }
 </style>
 <script>
 if (window.testRunner)
     testRunner.dumpAsText();

 function crash() {
     span = document.createElement('span');
     document.documentElement.appendChild(span);
     quote = document.createElement('q');
     quote.setAttribute('class', 'c15');
     document.documentElement.appendChild(quote);
     caption = document.createElement('caption');
     quote.appendChild(caption);
     span.offsetTop;
     span.appendChild(caption);
     span.offsetTop;
     span.innerHTML = "<a href='https://bugs.webkit.org/show_bug.cgi?id=95090'>Bug 95090</a>: Crash in RenderTable::removeCaption<br/>This test PASSED as it did not crash.";
 }
 window.onload = crash;
 </script>
	<!DOCTYPE html>
	<style>
	.c15:nth-last-of-type(-n+6) { display: table; }
	</style>
	<script>
	if (window.testRunner)
	testRunner.dumpAsText();

	function crash() {
	span = document.createElement('span');
	document.documentElement.appendChild(span);
	quote = document.createElement('q');
	quote.setAttribute('class', 'c15');
	document.documentElement.appendChild(quote);
	caption = document.createElement('caption');
	quote.appendChild(caption);
	span.offsetTop;
	span.appendChild(caption);
	span.offsetTop;
	span.innerHTML = "<a href='https://bugs.webkit.org/show_bug.cgi?id=95090'>Bug 95090</a>: Crash in RenderTable::removeCaption<br/>This test PASSED as it did not crash.";
	}
	window.onload = crash;
	</script>