third_party/WebKit/LayoutTests/fast/css-generated-content/table-row-group-to-inline.html

<style>
.first:before {
    display: table-row-group;
    content: "hello";
}

.second:before {
    display: inline;
    content: "hello";
}
</style>
<span>This test passes if it does not crash, and if we successfully destroy the table-section generated content.</span>
<br/>
<ul>
<li class="first" id="me">test</li>
</ul>

<script>
    var thing = document.getElementById("me");
    thing.className = "second";
</script>