LayoutTests/fast/css/first-letter-inline-flow-split-table-crash.html

<style>
.noFloat:empty { float: none; }
.theadStyle:nth-last-child(odd) { display: table-header-group; float: right; }
.pSpanStyle { overflow: hidden; -webkit-appearance: button; }
.pSpanStyle:first-letter { text-align: -webkit-left; content: counter(section); }
</style>
<script>
var parentSpan =  document.createElement('span');
var childSpan =  document.createElement('span');
var thead = document.createElement('thead');
var textNode = document.createTextNode('abc');

function removeTextNode() {
    childSpan.removeChild(textNode);
    delete textNode;
    if (window.testRunner)
        testRunner.notifyDone();
}

function changeClass() {
    thead.setAttribute('class', 'noFloat');
    setTimeout("removeTable()", 10);
}

function removeTable() {
    childSpan.removeChild(thead);
    setTimeout('removeTextNode();', 10);
}

function runTest() {
    parentSpan.setAttribute('class', 'pSpanStyle');
    document.documentElement.appendChild(parentSpan);
    childSpan.setAttribute('class', 'noFloat');
    parentSpan.appendChild(childSpan);
    thead.setAttribute('class', 'theadStyle');
    childSpan.appendChild(thead);
    childSpan.appendChild(textNode);
    setTimeout('changeClass();', 10);

    if (window.testRunner) {
        testRunner.waitUntilDone();
        testRunner.dumpAsText();
    }
}
window.onload = runTest;
</script>
PASS, if no exception or crash in debug