chromium/third_party/blink/web_tests/fast/css/counters/remove-anonymous-block-wrapper-crash.html

<!DOCTYPE html>
<style>
    #e0::after {
        position: absolute;
        content: counter(c);
    }
</style>
<p>Remove a block child, so that its parent block no longer needs to wrap inline children inside an anonymous block.</p>
<p>PASS if no crash or assertion failure.</p>
<div>
    <div id="e0" style="display:inline-block;">
        <div></div>
    </div>
    <div id="e1"></div>
</div>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();
    document.body.offsetTop;
    e1.style.display = "none";
</script>