block-add-child-crash.html | Explore in Territory

<!DOCTYPE html>
<html>
<body>
WebKit Bug 84606 - ASSERT(beforeChildAnonymousContainer->isTable()); fails in LayoutBlockFlow::addChildIgnoringAnonymousColumnBlocks.<br />
The test passes if it doesn't CRASH nor ASSERT.
<style>
.container { -webkit-column-count: 1; }
.columnSpan { -webkit-column-span: all; }
</style>
<li class="container">
<blockquote id="test">
<table class="columnSpan"></table>
</blockquote>
<textarea></textarea>
</li>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

document.body.offsetTop;
var test = document.getElementById("test");
test.outerHTML = "PASS";
</script>
</body>
</html>

chromium/third_party/blink/web_tests/fast/block/block-add-child-crash.html