<!DOCTYPE html>
<html>
<style>
.table {
    display: table;
    border-collapse: collapse;
}
.tableCell {
    display: table-cell;
}
.tableRowGroup {
    border-style: solid solid solid none;
    display: table-row-group;
}
</style>
<body style="-webkit-writing-mode: vertical-rl;">
<div class="table">
    A
    <span id="span1"></span>
    <span class="tableCell"></span>
<div>
</div>
<div class="tableRowGroup">B</div>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

document.body.offsetTop;
span1.style.display = "table-footer-group";

document.body.offsetTop;
document.body.innerHTML = "Bug <a href='https://bugs.webkit.org/show_bug.cgi?id=91160'>91160</a>: Crash in WebCore::RenderTable::cellBefore<br>PASS. WebKit didn't crash";
</script>
</body>
</html>