fast/table/crash-splitColumn.html

<!DOCTYPE html>
<html>
<head>
<style>
.lastTableHeaderGroup:last-of-type { display: table-header-group; }</style>
</style>
<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}

function crash()
{
    rubyTag.appendChild(lastTableHead);
    if (window.testRunner)
        testRunner.notifyDone();
}

function insertNodes() {
    var tableHead = document.createElement('th');
    tableHead.setAttribute('colspan', '5');
    tableHead.setAttribute('class', 'lastTableHeaderGroup');
    document.documentElement.appendChild(tableHead);
    tableHead.appendChild(document.createElement('p'));
    lastTableHead = document.createElement('th');
    document.documentElement.appendChild(lastTableHead);
    rubyTag = document.createElement('rt');
    setTimeout(crash, 0);
}
window.addEventListener("load", insertNodes, false);
</script>
</head>
<body>
<p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=70171">70171</a>: Crash in RenderTableSection::splitColumn</p>
<p> This test PASSES if it does not CRASH or ASSERT.</p>
</body>
</html>