clone-before-after-content-crash.html

<html>
  <head>
    <style>
      #test1 { -webkit-column-count: 1; }
      #test2 { display: block; }
      #test3::after { display: block; content: "A"; }
      #test4 { -webkit-column-span: all; }
    </style>
    <script>
	  if (window.testRunner)
	      testRunner.dumpAsText();
      function runTest(){
        test1 = document.createElement('div');
        test1.setAttribute('id', 'test1');
        document.body.appendChild(test1);
        test2 = document.createElement('div');
        test2.setAttribute('id', 'test2');
        test1.appendChild(test2);
        test3 = document.createElement('div');
        test3.setAttribute('id', 'test3');
        test2.appendChild(test3);
        test4 = document.createElement('span');
        test4.setAttribute('id', 'test4');
        test3.appendChild(test4);
        document.body.offsetTop;
        test4.style.display='block';
      }
      window.onload = runTest
    </script>
  </head>
  <body>
  Test passes if it does not crash.
  </body>
</html>

chromium/third_party/blink/web_tests/fast/multicol/span/clone-before-after-content-crash.html