empty-anonymous-block-split-crash.html

<!DOCTYPE html>
<html>
<head>
<style>
#test0 { -webkit-column-width: 1px; }
#test2::after { display: compact; content: ''; }
#test3 { content: counter(c); -webkit-column-span: all; }
</style>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

onload = function() {
    test0 = document.createElement('div');
    test0.setAttribute('id', 'test0');
    document.body.appendChild(test0); 
    test1 = document.createElement('div');
    test0.appendChild(test1);
    test2 = document.createElement('div');
    test2.setAttribute('id', 'test2');
    test1.appendChild(test2);
    test3 = document.createElement('div');
    test3.setAttribute('id', 'test3');
    test2.appendChild(test3);
    test2.appendChild(document.createTextNode('A'));
    document.designMode = 'on';
    document.execCommand('selectall');
    document.body.offsetTop;
    document.body.innerHTML = "WebKit Bug - Crash in multi-column layout.<br />PASS. WebKit didn't crash.";
}
</script>
</head>
<body>
</body>
</html>

chromium/third_party/blink/web_tests/fast/multicol/span/empty-anonymous-block-split-crash.html