chromium/src/third_party/blink/web_tests/fast/css-generated-content/resources/positioned-div-with-floating-after-content-crash-frame1.html

<style>
.c1 { display: table; }
.c1::after { position: fixed; content: counter(section); }
.c2 { display: table-caption; float: left; }
</style>
<script>
var node = document.createElement('q');

function changeQClass() {
    node.setAttribute('class', 'c1');
    setTimeout("appendQ();", 10);
}

function appendQ() {
    document.getElementById('positionedDiv').appendChild(node);
    setTimeout("navigateAway();");
}

function navigateAway() {
    // Bug only manifests on document destruction
    window.location="positioned-div-with-floating-after-content-crash-frame2.html";
}

function runTest() {
    setTimeout("changeQClass();", 10);
}
window.onload = runTest;
</script>
<div class="c2"><textarea></textarea></div>
<div id="positionedDiv" class="c1">FAIL</div>
<div class="c2"></div>