Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/fast/css-generated-content/quote-first-letter-crash.html 

<!DOCTYPE html>
<html>
<style>
.class1::first-letter { position: inherit; }
.class1:after { visibility: inherit; content: open-quote; }
</style>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function crash() {
    element1 = document.createElement('hr');
    element1.setAttribute('class', 'class1');
    document.documentElement.appendChild(element1);
    element2 = document.createElement('td');
    element2.setAttribute('class', 'class1');
    document.documentElement.appendChild(element2);
    document.documentElement.offsetTop;
    document.open();
    document.write("PASS. Test didn't crash.");
    document.close();
}
window.onload = crash;
</script>
</html>