text_combine_pseudo_element_crash.html

<!doctype html>
<style>
div {
 writing-mode: vertical-rl;
 font-size: 100px;
}
div::before { content: "[*]"; text-combine-upright: all; }
.bug::before { white-space: pre; }
}
</style>
<div id="target">ab</div>
<script>
document.body.offsetHeight;
const target = document.getElementById('target');
target.classList.add('bug');
</script>

chromium/third_party/blink/web_tests/fast/writing-mode/text_combine_pseudo_element_crash.html