tests/tests/webkitsecurity/assets/remove-div-from-flexible-box-with-floating-after-content-crash.html

<style>
.c1::after { float: left; content: open-quote; }
.c1:first-letter { display: table-column; }
.c1[class~="c1"] { display: -webkit-inline-box; }
</style>
<script>
var parentDiv = document.createElement('div');
var childDiv = document.createElement('div');

parentDiv.setAttribute('class', 'c1');
document.documentElement.appendChild(parentDiv);
parentDiv.appendChild(childDiv);
parentDiv.appendChild(document.createTextNode('PASS if no exception or crash'));
document.documentElement.offsetHeight; // forces a layout
parentDiv.removeChild(childDiv);
if (window.layoutTestController)
    layoutTestController.dumpAsText();
</script>