col_span_dynamic_crash.html | Explore in Territory

<!doctype html>
<style>
  col {
    border:2px solid green;
  }
</style>
<table style="border-collapse:collapse">
  <colgroup>
    <col span=3 id="target">
  </colgroup>
  <tbody>
    <tr>
      <td>a</td>
      <td>b</td>
    </tr>
  </tbody>
</table>
<script>
  document.body.offsetTop;
  document.querySelector("#target").setAttribute("span", 0);
</script>

chromium/third_party/blink/web_tests/external/wpt/css/css-tables/crashtests/col_span_dynamic_crash.html