LayoutTests/fast/lists/positioned-count-crash.html

<div>
<span>
<li>
<li id="test" style="position: absolute;list-style-type: upper-roman;">II
</div>

<div>
<br>
<br>
For manual test: If you see no crash and "II II", it means this test PASS.
</div>

<script src="resources/dump-list.js"></script>
<script>
    if (window.testRunner) {
        testRunner.dumpAsText();
        document.write(testListItemMarkerEqualsListItemText(document.getElementById("test")));
    }
</script>