LayoutTests/fast/inline/crash-new-continuation-with-outline.html - WebKit - Git at Google

 <!DOCTYPE html>
 <html>
 <head>
 <style>
     object:after {
         content: "ipsum";
     }
     object {
         opacity: 0.6039658321533352;
         visibility: hidden;
         outline-style: dotted;
     }
 </style>
 </head>
 <body>
 <p>Test case for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=84774">84774</a>: NULL-deref in RenderBox::clippedOverflowRectForRepaint</p>
 <script>
     if (window.testRunner)
         testRunner.dumpAsText();

     var objectElement = document.createElement("object");
     newContent = document.createTextNode("Lorem");
     objectElement.appendChild(newContent);
     document.body.appendChild(objectElement);

     var olElement = document.createElement("ol");
     objectElement.appendChild(olElement);

     document.body.appendChild(document.createTextNode("PASSED, this test did not crashed."));
 </script>
 </body>
 </html>
	<!DOCTYPE html>
	<html>
	<head>
	<style>
	object:after {
	content: "ipsum";
	}
	object {
	opacity: 0.6039658321533352;
	visibility: hidden;
	outline-style: dotted;
	}
	</style>
	</head>
	<body>
	<p>Test case for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=84774">84774</a>: NULL-deref in RenderBox::clippedOverflowRectForRepaint</p>
	<script>
	if (window.testRunner)
	testRunner.dumpAsText();

	var objectElement = document.createElement("object");
	newContent = document.createTextNode("Lorem");
	objectElement.appendChild(newContent);
	document.body.appendChild(objectElement);

	var olElement = document.createElement("ol");
	objectElement.appendChild(olElement);

	document.body.appendChild(document.createTextNode("PASSED, this test did not crashed."));
	</script>
	</body>
	</html>