chromium/third_party/blink/web_tests/fast/multicol/span/positioned-objects-not-removed-crash.html

<!DOCTYPE html>
<html>
<body>
<style>
#test0 { -webkit-columns: 1px; } 
#test1 { -webkit-perspective: 1; display: compact; }
#test1:before { content: ""; } 
#test1:after { display: table; content: ""; } 
#test2 { -webkit-column-span: all; }
#test4:last-child { position:fixed; } 
.c0 { display: table-header-group; } 
.c1:first-letter { content: ""; }
</style>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

onload = function() {
    test0 = document.createElement('div');
    test0.setAttribute('id', 'test0');
    document.body.appendChild(test0);
    test1 = document.createElement('div');
    test1.setAttribute('id','test1');
    test0.appendChild(test1);
    test2 = document.createElement('div');
    test2.setAttribute('id','test2');
    test1.appendChild(test2);
    test3 = document.createElement('span');
    test1.appendChild(test3);
    test4 = document.createElement('div');
    test4.setAttribute('id', 'test4'); 
    test3.appendChild(test4);
    document.body.offsetTop;
    test2.setAttribute('class', 'c0'); 
    test4.setAttribute('class', 'c1');
    document.body.offsetTop;
    document.body.innerHTML = "WebKit Bug - Crash in multi-column layout.<br />PASS. WebKit didn't crash.";
}
</script>
</body>
</html>