chromium/third_party/blink/web_tests/fast/css/counters/counter-after-style-crash.html

<html>
  <script>
  if (window.testRunner) {
    testRunner.waitUntilDone();
    testRunner.dumpAsText();
  }
  </script>
  <style>
    div {
      counter-reset:ctr
    }

    :after {
      content:counter(x);
      counter-increment:ctr;
    }
  </style>                          
  <junk>TESTING..</div><div><div></div>
  <span></span>
  <table>
    </script>
    <script>
      document.designMode='on';
      document.execCommand('selectall');
      document.execCommand('italic');
      document.execCommand('removeformat');

      document.body.innerHTML = "PASS: Counters updated successfully without crashing";
      testRunner.notifyDone();
    </script>
  </table>
</html>