<!DOCTYPE html> <body style="display: inline-grid;"> <style> .absolutelyPositioned { position: absolute; } </style> crbug.com/280451 - Heap-use-after-free in WebCore::LayoutGrid::computePreferredTrackWidth</br> This test has passed if it didn't crash. <script> if (window.testRunner) testRunner.dumpAsText(); var cell = document.createElement("cell"); cell.setAttribute("class", "absolutelyPositioned"); document.body.appendChild(cell); window.scrollBy(98, 28); cell.setAttribute("class", "nonExistent"); </script>