chromium/third_party/blink/web_tests/fast/css/crash-inherit-value-font-family.html

<!DOCTYPE html>
<body>
<var style="float: right; border-block-start: groove; font-family: inherit"></var>

<script>
    if (window.testRunner)
        testRunner.dumpAsText();

    document.body.offsetTop;
    document.designMode="on";
    document.execCommand("SelectAll");
    document.execCommand("InsertImage", false);
    document.execCommand("InsertOrderedList");
    document.body.innerHTML = "crbug.com/279286: ASSERT: Bad cast from CSSInitialValue to CSSValueList<br>This test has passed if it doesn't crash";
</script>