LayoutTests/fast/css-generated-content/before-content-with-list-marker-in-anon-block-crash.html

<style>
.c9::before { float: right; content: counter(section); }
.c9 { display: list-item; }
.c19 { display: table-row; }
.c19:nth-child(even) { position: fixed; }
</style>
<script>
var nodes = Array();
function runTest() {
    firstDiv = document.createElement('div');
    document.documentElement.appendChild(firstDiv);

    secondDiv = document.createElement('div');
    document.documentElement.appendChild(secondDiv);

    childDivListItem = document.createElement('div');
    childDivListItem.setAttribute('class', 'c9');
    document.documentElement.appendChild(childDivListItem);

    citeNode = document.createElement('cite');
    citeNode.setAttribute('class', 'c19');
    document.documentElement.appendChild(citeNode);

    parentDivListItem = document.createElement('div');
    parentDivListItem.setAttribute('class', 'c9');
    
    citeNode.appendChild(parentDivListItem);

    document.body.offsetTop;
    parentDivListItem.appendChild(childDivListItem);
    document.body.offsetTop;
    secondDiv.setAttribute('class', 'c1');
    document.body.offsetTop;
    firstDiv.setAttribute('class', 'c1');

    if (window.testRunner)
        testRunner.dumpAsText();
}
window.onload = runTest;
</script>
PASS if no assert or crash on debug