normalize-with-first-letter-and-before-content-crash.html

<!doctype html>
<style>
.absolutePosition { position: fixed; }
.float:before { float: right; content: ''; }
.float:first-letter { float: right; }
.inline::first-letter { content: ''; }
</style>
<script>
function crash() {
    document.body.offsetTop;
    parent = document.getElementById('parent');
    child.setAttribute('class', 'inline');
    document.body.offsetTop;
    parent.removeChild(child);
    parent.normalize();
}
window.onload = crash;
if (window.testRunner)
    testRunner.dumpAsText();
</script>
<div class="float" id="parent">
<div class="absolutePosition" id="child"></div>
Test passes if no crash.

chromium/third_party/blink/web_tests/fast/css-generated-content/normalize-with-first-letter-and-before-content-crash.html