rtl-replace-cells-with-colspan-crash.html

<!DOCTYPE html>
<script src="../resources/testharness.js"></script>
<script src="../resources/testharnessreport.js"></script>

<p>PASS if no crash or assertion failure.</p>
<div id="container" style="direction:rtl;">
    <div style="display:table-cell;"></div>
    <div id="remove1" style="display:table-cell;"></div>
    <div id="remove2" style="display:table-cell;"></div>
    <div id="rowLater" style="display:none;"></div>
</div>
<script>
test(() => {
  var cell = document.createElement('td');
  cell.setAttribute('colspan', '3');
  cell.style.display = "none";
  rowLater.appendChild(cell);

  document.body.offsetTop;
  remove1.style.display = "none";
  remove2.style.display = "none";
  rowLater.style.display = "table-row";

  document.body.offsetTop;
  cell.style.display = "table-cell";
}, "No crash or assertion failure.");
</script>

chromium/third_party/blink/web_tests/tables/rtl-replace-cells-with-colspan-crash.html