LayoutTests/fast/css-generated-content/floating-before-content-with-list-marker-crash.html

<style>
.floatingBefore::before { overflow: visible; float: left; content: open-quote; }
</style>
<script>
tbodyElement = document.createElement('tbody');
listItemElement = document.createElement('li');
listItemElement.setAttribute('class', 'floatingBefore');
document.documentElement.appendChild(listItemElement);
headerElement = document.createElement('header');
listItemElement.appendChild(headerElement);
listItemElement.appendChild(document.createElement('sub'));
document.documentElement.offsetHeight;
tbodyElement.appendChild(headerElement);

document.documentElement.appendChild(document.createTextNode('PASS if no crash or assert in debug'));

if (window.testRunner)
    testRunner.dumpAsText();
</script>