first-letter-associated-text-node-crash.html

<!doctype html>

<style>
  body:first-letter { position: fixed; float: inherit; }
  #target { display: none; }
</style>

<body>
  <div id="target">
    Test passes if it does not CRASH.
    <span id="line"></span>
  </div>
</body>

<script>
if (window.testRunner)
  testRunner.dumpAsText();

document.body.insertBefore(target, document.body.lastChild);

target.addEventListener('DOMNodeRemovedFromDocument', function() {
  var range = document.createRange();
  range.selectNodeContents(target);
  document.body.appendChild(range.extractContents());

  target.insertAdjacentHTML('beforebegin', 'A');

  target.offsetTop;
  target.parentElement.normalize();
}, false);

document.write('Text');

line.getBoundingClientRect();
document.body.appendChild(target);
</script>

chromium/third_party/blink/web_tests/dom/mutation-event-tests/fast/css/first-letter-associated-text-node-crash.html