first-letter-next-sibling-crash.html

<!DOCTYPE html>
<html>
<style>
.absolutePosition { position: fixed; }
.float:before { float: right; content: ''; }
.float:first-letter { float: right; }
.inline::first-letter { content: ''; }
</style>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function startTest() {
    document.body.offsetTop;
    var parent = document.getElementById("parent");
    var child = document.getElementById("child");
    child.setAttribute('class', 'inline');
    document.body.offsetTop;
    parent.removeChild(child);
    document.body.offsetTop;
    parent.setAttribute('class', 'inline');
}
window.onload = startTest;
</script>
WebKit Bug 85759 - Crash in LayoutBlockFlow::updateFirstLetterStyle.
<div class="float" id="parent">
<div class="absolutePosition" id="child"></div>
PASS if test does not crash.
</div>
</html>

chromium/third_party/blink/web_tests/fast/css-generated-content/first-letter-next-sibling-crash.html