chromium/third_party/blink/web_tests/fast/css/rtl-nth-child-first-letter-crash.html

}
<style>
 *:nth-child(2):first-letter {float: left;direction: rtl;
</style>
<p>NULL pointer crash in TextIterator::handleTextBox() when using RTL text.
If there is no crash, then the test passes.</p>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();
</script>
<p>If you can see this, then the test passes.</p>