counter-traverse-object-crash.html | Explore in Territory

<html>
    <script>
        function test()
        {
            if (window.testRunner)
                testRunner.dumpAsText();
            document.getElementsByTagName("div")[0].outerHTML = "PASS";
        }
    </script>
    This tests that we do not crash when LayoutCounter traverses detached render trees.
    <body onload="test()" style="counter-increment: ctr">
        <object>
            <b style="counter-increment: ctr"><div></div></b>
            <menu style="counter-increment: ctr"></menu>
        </object>
    </body>
</html>

chromium/third_party/blink/web_tests/fast/css/counters/counter-traverse-object-crash.html