LayoutTests/editing/selection/extend-by-line-anonymous-content-crash.html

<style>
    #b:before { content: "bar"; }
</style>
<p>
    Test for <a href="rdar://problem/6081309">rdar://problem/6081309</a>, a crash when moving or extending the selection with line granularity.
</p>
<div id="target">foo</div>
<div id="b">baz</div>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();

    var sel = getSelection();
    var start = document.getElementById("target").firstChild;
    sel.setBaseAndExtent(start, 0, start, 1);
    sel.modify("extend", "forward", "line");
</script>