LayoutTests/fast/inline/fieldset-inline-crash.html

<script>
if (window.testRunner)
    testRunner.dumpAsText();
</script>
<style>
fieldset { display: inline }
span { float: left }
</style>
<span>
<fieldset>
This test passes if it doesn't crash.