LayoutTests/fast/css-generated-content/positioned-generated-content-under-run-in-crash.html

<style>
.testclass::before { position: absolute; content: ""; }
.testclass { display: run-in; }
</style>
PASS, if no exceptions or crash observed
<script>
function runTest() 
{
    test1 = document.createElement('div');
    test1.setAttribute('class', 'testclass');
    document.documentElement.appendChild(test1);
    test2 = document.createElement('b');
    test2.setAttribute('class', 'testclass');
    document.documentElement.appendChild(test2);
    test3 = document.createElement('div');
    document.documentElement.appendChild(test3);
    if (window.testRunner)
        testRunner.dumpAsText();
}
window.onload = runTest;
</script>