| Index: LayoutTests/fast/multicol/span/table-column-crash.html
 | 
| diff --git a/LayoutTests/fast/multicol/span/table-column-crash.html b/LayoutTests/fast/multicol/span/table-column-crash.html
 | 
| new file mode 100644
 | 
| index 0000000000000000000000000000000000000000..dae917f29e80421df333f2c527006075f53f1dc4
 | 
| --- /dev/null
 | 
| +++ b/LayoutTests/fast/multicol/span/table-column-crash.html
 | 
| @@ -0,0 +1,29 @@
 | 
| +<!DOCTYPE html>
 | 
| +<script>
 | 
| +    if (window.testRunner)
 | 
| +        testRunner.dumpAsText();
 | 
| +</script>
 | 
| +<style>
 | 
| +#invalid-spanner { display:none; -webkit-column-span:all; }
 | 
| +</style>
 | 
| +
 | 
| +Test passes if it does not CRASH.
 | 
| +<div style="-webkit-column-count:1;">
 | 
| +    <div>
 | 
| +        <span id="inline" style="display:none;"></span>
 | 
| +        <div id="invalid-spanner"></div>
 | 
| +    </div>
 | 
| +</div>
 | 
| +
 | 
| +<script>
 | 
| +    document.body.offsetTop;
 | 
| +    document.getElementById("inline").style.display = "inline";
 | 
| +
 | 
| +    // Note that a table-column isn't allowed to become a spanner.
 | 
| +    document.getElementById("invalid-spanner").style.display = "table-column";
 | 
| +
 | 
| +    onload = function() {
 | 
| +        document.body.offsetTop;
 | 
| +        document.getElementById("invalid-spanner").style.webkitColumnSpan = "none";
 | 
| +    }
 | 
| +</script>
 | 
| 
 |