chromium/third_party/blink/web_tests/fast/css-generated-content/bug91547.html

<!DOCTYPE html>
<script>
if (window.testRunner) {
    testRunner.waitUntilDone();
    testRunner.dumpAsText();
}
onload = function() {
    if (location.hash != "#1") {
        location.hash = '#1';
        setTimeout(function(){ location.reload() }, 0);
    } else {
        // If you run this test in Safari you'll still see this text even if Webkit crashed
        // because Safari instantly reloads the page with the #1 url.
        document.body.appendChild(document.createTextNode('PASS: WebKit did not crash.'));
        if (window.testRunner)
            testRunner.notifyDone();
    }
}
</script>
<style>
    section::after {
        float: left;
        content: open-quote; 
    }
</style>

<section>
    <div></div>
    Should not crash.
</section>