grid-item-before-anonymous-child-crash.html

<body>
  <p>This test checks that adding a new grid item before an already existing item wrapped by an anonymous block does not crash under ASAN.</p>
  <div id=grid style="display: grid; grid-auto-flow: stack;">X</div>
</body>
<script type="text/javascript">
 if (window.testRunner)
   testRunner.dumpAsText();

 document.addEventListener("DOMContentLoaded", crash, false);

 function crash() {
   document.designMode = 'on';
   window.getSelection().selectAllChildren(grid);
   document.execCommand("Italic", null);
 }
</script>

chromium/third_party/blink/web_tests/fast/css-grid-layout/grid-item-before-anonymous-child-crash.html