LayoutTests/fast/flexbox/crash-anonymous-box.html - WebKit - Git at Google

 <!DOCTYPE html>
 <html><head>
 <script>
 if (window.testRunner)
     testRunner.dumpAsText();
 </script>

 </head><body>
 <p>This shouldn't crash.</p>

 <button style="display: -webkit-box;">Button</button>

 </body></html>
	<!DOCTYPE html>
	<html><head>
	<script>
	if (window.testRunner)
	testRunner.dumpAsText();
	</script>

	</head><body>
	<p>This shouldn't crash.</p>

	<button style="display: -webkit-box;">Button</button>

	</body></html>