LayoutTests/fast/css/counters/findPlaceForCounter-parent-renderer-crash.html - WebKit - Git at Google

 <!DOCTYPE html>
 <style>
   html {
     counter-increment: x;
   }
   body {
     counter-increment: x;
     contain: strict;
   }
 </style>
 <script>
   onload = () => {
     d.style = 'counter-increment: x';
     if (window.testRunner)
       testRunner.dumpAsText();
   };
 </script>
 <div id="d">PASS if this doesn't crash</div>
	<!DOCTYPE html>
	<style>
	html {
	counter-increment: x;
	}
	body {
	counter-increment: x;
	contain: strict;
	}
	</style>
	<script>
	onload = () => {
	d.style = 'counter-increment: x';
	if (window.testRunner)
	testRunner.dumpAsText();
	};
	</script>
	<div id="d">PASS if this doesn't crash</div>