<html>
    <script>
        function test()
        {
            if (window.layoutTestController)
                layoutTestController.dumpAsText();
            document.getElementsByTagName("div")[0].outerHTML = "PASS";
        }
    </script>
    This tests that we do not crash when RenderCounter traverses detached render trees.
    <body onload="test()" style="counter-increment: ctr">
        <object>
            <b style="counter-increment: ctr"><div></div></b>
            <menu style="counter-increment: ctr"></menu>
        </object>
    </body>
</html>