positioned-object-under-split-block-parent-crash.html

<!DOCTYPE html>
<html>
<style>
.colContainer { -webkit-column-count: 0; }
.absolutePosition { position: absolute; }
.colSpanAll { -webkit-column-span: all; }
.transformed { transform: rotate(45deg); }
.hidden { display:none; }
.normal { display:block;}
</style>
<script>

window.onload = function() {
    columnContainerBlock = document.createElement('div');
    columnContainerBlock.setAttribute('class', 'colContainer');
    document.documentElement.appendChild(columnContainerBlock);

    splitBlockParent = document.createElement('div');
    splitBlockParent.setAttribute('class', 'transformed');
    columnContainerBlock.appendChild(splitBlockParent);

    splitFlowDt = document.createElement('dt');
    splitBlockParent.appendChild(splitFlowDt);

    positionedDiv = document.createElement('div');
    positionedDiv.setAttribute('class', 'absolutePosition');
    splitBlockParent.appendChild(positionedDiv);

    columnSpan = document.createElement('col');
    columnSpan.setAttribute('class', 'colSpanAll');
    splitFlowDt.appendChild(columnSpan); // Inserting the col inside the dt causes it to get split.
    document.documentElement.offsetHeight;

    splitFlowDt.setAttribute('class', 'hidden'); // This removes the split dt and the col from the render tree.
    document.documentElement.offsetHeight;

    splitFlowDt.setAttribute('class', 'normal'); // Re-adding the dt causes the flow to split again.
    document.documentElement.offsetHeight;

    splitBlockParent.removeChild(positionedDiv); // Remove the positioned object from the tree.
    document.documentElement.offsetHeight;

    splitBlockParent.removeChild(splitFlowDt); // Ensure the node with the bad positioned object list gets layout.

    if (window.testRunner)
        testRunner.dumpAsText();
}
</script>
<body>
PASS if no assert or crash in debug
</body>
</html>
chromium/third_party/blink/web_tests/fast/block/positioning/positioned-object-under-split-block-parent-crash.html
