sousa-gecko/testing/web-platform/tests/css/css-content/crashtests/generated-counter.html

<!DOCTYPE html>
<meta charset="utf-8">
<title>Generated counter content in ::before should not crash layout</title>
<link rel="help" href="https://bugs.webkit.org/show_bug.cgi?id=61411">
<style>
div::before {
  counter-reset: foobar;
  content: counter(foobar, upper-roman);
  display: block;
  overflow: hidden;
  width: 100px;
  height: 100px;
}
</style>
<div></div>
<script>
  document.body.offsetTop;
</script>