chromium/third_party/blink/web_tests/fast/css/first-letter-inline-flow-split-crash.html

<style>
.spanStyle { float: inherit; }
.inlineFL::first-letter { visibility: visible; }
.floatFL { float: right; }
.floatFL::first-letter { position: absolute; content: 'A'; }
</style>
PASS, if no exception or crash observed
<script>
parentDiv = document.createElement('div');
childSpan = document.createElement('span');
childDiv = document.createElement('div');
textNode =  document.createTextNode('bcd');

function removeTextNode() {
    parentDiv.removeChild(textNode);
    delete textNode;
    if (window.testRunner)
        testRunner.notifyDone();
}

function changeClass() {
    parentDiv.setAttribute('class', 'inlineFL');
    setTimeout("removeTextNode()", 10);
}

function runTest() {
    parentDiv.setAttribute('class', 'floatFL');
    document.documentElement.appendChild(parentDiv);
    childSpan = document.createElement('span');
    childSpan.setAttribute('class', 'spanStyle');
    parentDiv.appendChild(childSpan);
    parentDiv.appendChild(textNode);
    childSpan.appendChild(childDiv);
    setTimeout("changeClass()", 10);
    if (window.testRunner) {
        testRunner.waitUntilDone();
        testRunner.dumpAsText();
    }
}
window.onload = runTest;
</script>