Passes if no crash with --enable-blink-features=PaintUnderInvalidationChecking.
<style>
* { float: right; margin-bottom: 10000000px; }
</style>
<div id="target"></div>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<script src="../../resources/run-after-layout-and-paint.js"></script>
<script>
if (window.testRunner && window.internals) {
  internals.runtimeFlags.paintUnderInvalidationCheckingEnabled = true;
  async_test(t => {
    runAfterLayoutAndPaint(t.step_func_done(() => {
      target.style.width = '600px';
    }));
  });
}
</script>