chromium/third_party/blink/web_tests/fast/css/counters/destroy-counter-crash.html

<html>
  <head>
    <style type="text/css">
    div { counter-reset: c }
    iframe { counter-reset: c }
    h1:after { content: counter(c) }
    </style>
    <script>
    if (window.testRunner)
        testRunner.dumpAsText();

    window.onload = function () {
        var testElement = document.getElementById("test");
        document.body.removeChild(testElement);
        var p = document.createElement("p");
        p.appendChild(document.createTextNode("TEST PASSED"));
        document.body.appendChild(p);
    }
    </script>
  </head>
  <body>
  This test is to ensure that we do not crash when destroying counter nodes.
    <div id="test">
      <iframe/>
      <h1/>
    </div>
  </body>
</html>