[css-flexbox] Move inline-flex-crash.html to WPT

This CL migrates this test out of
third_party/blink/web_tests/css3/filters and into the WPT-specific
directory, adding links to the relevant specs and a test assertion
describing its purpose and renames
inline-flex-editing-with-updating-text-crash.html

Bug: 1063749
Change-Id: I62ca5c5f28b14b6258eec90ce029289a70e7c14f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2152135
Reviewed-by: David Grogan <dgrogan@chromium.org>
Reviewed-by: Christian Biesinger <cbiesinger@chromium.org>
Reviewed-by: Robert Ma <robertma@chromium.org>
Commit-Queue: David Grogan <dgrogan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#759735}
diff --git a/css/css-flexbox/inline-flex-editing-with-updating-text-crash.html b/css/css-flexbox/inline-flex-editing-with-updating-text-crash.html
new file mode 100644
index 0000000..bdf7df8
--- /dev/null
+++ b/css/css-flexbox/inline-flex-editing-with-updating-text-crash.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<title>CSS Flexbox: inline-flex layout with updating text and editing operations</title>
+<link rel="help" href="https://drafts.csswg.org/css-flexbox/#flex-containers">
+<link rel="help" href="https://bugs.webkit.org/show_bug.cgi?id=77772">
+<link rel="help" href="https://crbug.com/118662">
+<meta name="assert" content="This test ensures that inline-flex layout does not crash with updating text and editing operations.">
+<style>#el0::first-letter, #el0:first-child { height: 10px; }</style>
+<div id='container' contentEditable>
+  <a>
+    <img>
+    <div id="el0" style="display: inline-flex">
+      <pre></pre>
+    </div>
+  </a>
+</div>
+<script>
+document.querySelector('pre').textContent = 'AA\u0605';
+window.getSelection().selectAllChildren(document.getElementById('container'));
+document.execCommand('FormatBlock', false, '<h1>');
+</script>