counter-reset-subtree-insert-crash.html

<style>
#el0::after {
  content: counter(c);
  counter-increment: c;
}

#el1 {
  content: counter(c);
  counter-increment: c;
}

#el2 {
  content: counter(c);
  counter-increment: c;
}

#el2::after {
  content: counter(c);
}

#el3 {
  position: absolute;
}

#el3::before {
  content: counter(c);
  counter-reset: c;
}

#el3:after {
  content: counter(c);
  counter-reset: c;
}

#el4 {
  counter-increment: c;
}

#el5 {
  content: counter(c);
  counter-increment: c;
}
</style>
<script>
if (window.testRunner)
  testRunner.dumpAsText();

window.onload = function() {
  rules = [
    "#el2::after { counter-increment: c; } ",
    "xyz { } "
  ];
  stylesheet = document.styleSheets[0];
  document.body.offsetTop;
  stylesheet.insertRule(rules[0], stylesheet.cssRules.length);
  document.body.offsetTop;
  stylesheet.insertRule(rules[1], stylesheet.cssRules.length)
  document.body.innerHTML = "PASS: reparenting a counter node subtree that contains resets does not cause a crash.";
}
</script>

<body>
  <span id="el0">
    <div id="el1"></div>
    <div id="el2">
      <div id="el3"></div>
      <span id="el4"></span>
    </div>
    <div id="el5"></div>
  </span>
</body>

chromium/third_party/blink/web_tests/fast/css/counters/counter-reset-subtree-insert-crash.html