update-after-content-before-child-crash.html

<!DOCTYPE html>
<html>
<body>
<style>
#columnContainer { -webkit-column-count: 600; }
#divBlock::after { display: block; content: ''; }
#columnSpanBlock:nth-last-child(even) { -webkit-column-span: all; }
#table { float: right; }
</style>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

onload = function() {
    columnContainer = document.createElement('div');
    columnContainer.setAttribute('id', 'columnContainer');
    document.body.appendChild(columnContainer);
    divBlock = document.createElement('div');
    divBlock.setAttribute('id', 'divBlock');
    columnContainer.appendChild(divBlock);
    columnSpanBlock = document.createElement('div');
    columnSpanBlock.setAttribute('id', 'columnSpanBlock');
    divBlock.appendChild(columnSpanBlock);
    span = document.createElement('span');
    divBlock.appendChild(span);
    span.appendChild(document.createTextNode('A'));
    table = document.createElement('table');
    table.setAttribute('id', 'table');
    divBlock.appendChild(table);
    document.designMode = 'on';
    document.execCommand('selectall');
    document.execCommand('inserttext', '');
    document.body.offsetTop;
    document.body.innerHTML = "PASS. WebKit didn't crash.";
}
</script>
</body>
</html>

chromium/third_party/blink/web_tests/fast/multicol/span/update-after-content-before-child-crash.html