<head>
<style>
.gone { display:none }
</style>
<script>
if (window.testRunner)
testRunner.dumpAsText();
</script>
<body>
Loading this page should not crash.
<table>
<td id=td1>
.<input id=cb type="checkbox">.
</table>
<script>
var sel = window.getSelection();
var td1 = document.getElementById('td1')
// having selection triggers Document::updateRendering() from paint()
sel.setBaseAndExtent(td1, 0, td1, 1000);
// this causes style recalc and rendering tree tear down (from updateRendering) in middle of painting, which crashes
document.body.setAttribute('class','gone');
var cb = document.getElementById('cb')
// this triggers synchronous paint()
cb.click();
document.body.setAttribute('class','');
</script>
</body>