crash-splitColumn-3.html | Explore in Territory

<!DOCTYPE html>
<html>
<head>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function crash()
{
    var firstCell = document.getElementById("firstCell");
    firstCell.parentNode.removeChild(firstCell);
}

window.addEventListener("load", crash, false);
</script>
</head>
<body>
<p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=70171">70171</a>: Crash in LayoutTableSection::splitColumn</p>
<p> This test PASSES if it does not CRASH or ASSERT.</p>
<table><tr><td id="firstCell">foobar</td><td colspan="2"></td><td></td></tr></table>
</body>
</html>

chromium/third_party/blink/web_tests/fast/table/crash-splitColumn-3.html