chromium/third_party/blink/web_tests/fast/css/counters/render-tree-reorg-crash.html

<spacer style='counter-increment: a'>
<spacer>
<f id='f'>
</spacer>
<c>
  <spacer style='counter-increment: a'>
</c>
<spacer style='counter-increment: a'>
<div id='p' style='counter-reset: a'>
<script>
  if (window.testRunner)
    testRunner.dumpAsText();   
  document.getElementById('f').appendChild(document.getElementById("p"));
</script>
This test passes if it does not crash.<br>
Bug: <a href="https://bugs.webkit.org/show_bug.cgi?id=54478">54478</a>