textbox-not-removed-crash.html | Explore in Territory

<!DOCTYPE html>
<html>
<head>
<style>
#test1 {
    text-indent: -1em;
    content: counter(c);
    -webkit-column-count: 1;
}
#test3 {
    -webkit-column-span: all;
}
</style>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function crash() {
    test1 = document.createElement('div'); 
    test1.setAttribute('id', 'test1'); 
    document.body.appendChild(test1);
    test2 = document.createElement('div'); 
    test1.appendChild(test2);
    test3 = document.createElement('div'); 
    test3.setAttribute('id', 'test3');
    test2.appendChild(test3);
    test2.appendChild(document.createTextNode('A')); 
    test2.style.display = '-webkit-box';
    document.body.offsetTop;
    test3.style.display = 'list-item';
    document.body.offsetTop;
    document.body.style.zoom = 2;
}
window.onload = crash;
</script>
</head>
<body>
Test passes if it does not crash.
</body>
</html>

chromium/third_party/blink/web_tests/fast/multicol/span/textbox-not-removed-crash.html