crash-in-attachFirstLetterTextLayoutObjects.html

<!DOCTYPE html>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<style>
.c3 { -webkit-appearance: button; }
.c3:nth-last-child(even) { display: table-row; }
.c14 { float: left; }
.c14::first-letter { float: inherit; }
</style>
<div id="div" class="c14">
	<div class="c3">
		Test passes if it doesn't crash.
	</div>
</div>
<script>
test(function() {
	setTimeout('div.appendChild(document.createElement("div"));', 0);
	assert_true(true, "Should not crash");
}, "Check that we clear pseudoElement from ElementRareData when FirstLetterPseudoElement doesn't have a LayoutObject");
</script>

chromium/third_party/blink/web_tests/fast/css/crash-in-attachFirstLetterTextLayoutObjects.html