chromium/third_party/blink/web_tests/fast/css/render-quote-crash.html

<!DOCTYPE html>

<head id='head'>!
<style>
  .quote:first-letter { visibility: inherit; }
  .quote { -webkit-appearance: button; }
</style>

<script>
if (window.testRunner)
    testRunner.dumpAsText();

window.onload = function() {
  var quote = document.createElement('q');
  document.documentElement.appendChild(quote);

  var quote3 = document.createElement('q');
  quote3.setAttribute('class', 'quote');
  quote.appendChild(quote3);

  document.body.offsetTop;
  body.textContent = head.innerHTML;
}
</script>
</head>

<body id='body'>
  Test passes if it does not CRASH.

  <style>
  * {
    justify-items: center;
    quotes: "a" "b" "c" "d";
  }
  </style>
</body>