chromium/third_party/blink/web_tests/virtual/text-antialias/international/bidi-neutral-in-mixed-direction-run-crash.html

<html>
<style>
    body { direction: rtl; padding-left: 100%; }
</style>
<script>
    if (window.testRunner)
         testRunner.dumpAsText();

    function runTest() {
        document.body.innerHTML = "PASS, if no crash or exceptions thrown";
    }

    window.onload = runTest;
</script>
0<span>
<image>
A 0<div></div>
</span>
</html>