chromium/third_party/blink/web_tests/fast/css/counters/asterisk-counter-update-after-layout-crash.html

<style>
.x:after { content:counter(c, asterisks) ""; counter-increment:c 1550; }
</style>
<script>
function runTest() {
    document.styleSheets[0].insertRule("div { counter-reset: c 141170 }", 0);
    if (window.testRunner)
        testRunner.dumpAsText();
}
window.onload=runTest;
</script>
<div>
    <span class="x">
    <div></div>
    <span class="x">
    <p>
    <p>
    PASS if no assert or crash in debug
</div>