css/css-flexbox/contain-size-layout-abspos-flex-container-crash.html

<!DOCTYPE html>
<html>
  <meta charset="UTF-8">
  <link rel="author" title="Ting-Yu Lin" href="mailto:tlin@mozilla.com">
  <link rel="author" title="Mozilla" href="https://www.mozilla.org/">
  <link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1678469">
  <meta name="assert" content="This test ensures that the browser does not crash after removing the element 'c'.">

  <style>
  html { columns: 0 }
  body {
    transform: rotate(14deg);
  }
  #flex-container {
    display: flex;
    contain: size layout;
    position: absolute;
    width: 100px;
    height: 100px;
  }
  </style>

  <script>
  function boom() {
    let flex = document.getElementById('flex-container');
    let c = document.getElementById('c');
    flex.removeChild(c);
  }
  </script>

  <body onload="boom()">
    <div id="flex-container">
      x
      <div id="c"></div>
    </div>
  </body>
</html>