table-section-visual-overflowing-cell-crash.html

<!doctype HTML>
<style>
.c8 {-webkit-column-width: 1px; }
.c12 { content: no-close-quote; padding-right: 10px; }
.c12 { vertical-align: -10%; padding-bottom: 100%; }
.c18 { display: table-header-group; }
</style>
Passes if it does not crash.
<script>
  var cell1 = document.createElement('td');
  cell1.setAttribute('class', 'c8');
  document.documentElement.appendChild(cell1);

  var cell2 = document.createElement('td');
  cell2.setAttribute('rowspan', '65536');
  document.documentElement.appendChild(cell2);

  span = document.createElement('span');
  span.setAttribute('class', 'c12')

  cell2.appendChild(span);
  setTimeout(() => cell2.setAttribute('class', 'c18'), 0);
</script>

chromium/third_party/blink/web_tests/tables/table-section-visual-overflowing-cell-crash.html