<!DOCTYPE html><!-- webkit-test-runner [ KeygenElementEnabled=true ] -->
<html>
Webkit Bug 86019 - Crash due to floats not removed from first-letter element.
<style>
.li2 { width: 0px; }
.li2:first-letter { float: left; content: counter(section); }
.li2:first-of-type { display: -webkit-inline-flexbox; }
</style>
<script>
if (window.testRunner)
    testRunner.dumpAsText();
    
function crash() {
    li1 = document.createElement('li');
    document.documentElement.appendChild(li1);
    keygen1 = document.createElement('keygen');
    keygen1.setAttribute('autofocus', 'autofocus');
    document.documentElement.appendChild(keygen1);
    li2 = document.createElement('li');
    li2.setAttribute('class', 'li2');
    document.documentElement.appendChild(li2);
    text1 = document.createTextNode("PASS. WebKit didn't crash.");
    li2.appendChild(text1);
}
window.onload = crash;
</script>
</html>