<head>
<style>
.gone { display:none }
</style>
<script>
if (window.layoutTestController)
    layoutTestController.dumpAsText();
</script>
<body>
Loading this page should not crash.
<table>
<td id=td1>
.<input id=cb type="checkbox">.
</table>
<script>
    var sel = window.getSelection();
    var td1 = document.getElementById('td1')
    // having selection triggers Document::updateRendering() from paint()
    sel.setBaseAndExtent(td1, 0, td1, 1000);
    // this causes style recalc and rendering tree tear down (from updateRendering) in middle of painting, which crashes
    document.body.setAttribute('class','gone');
    var cb = document.getElementById('cb')
    // this triggers synchronous paint() 
    cb.click();  
    document.body.setAttribute('class','');  
</script>
</body>