LayoutTests/fast/table/crash-splitColumn.html - WebKit - Git at Google

 <!DOCTYPE html>
 <html>
 <head>
 <style>
 .lastTableHeaderGroup:last-of-type { display: table-header-group; }</style>
 </style>
 <script>
 if (window.testRunner) {
     testRunner.dumpAsText();
     testRunner.waitUntilDone();
 }

 function crash()
 {
     rubyTag.appendChild(lastTableHead);
     if (window.testRunner)
         testRunner.notifyDone();
 }

 function insertNodes() {
     var tableHead = document.createElement('th');
     tableHead.setAttribute('colspan', '5');
     tableHead.setAttribute('class', 'lastTableHeaderGroup');
     document.documentElement.appendChild(tableHead);
     tableHead.appendChild(document.createElement('p'));
     lastTableHead = document.createElement('th');
     document.documentElement.appendChild(lastTableHead);
     rubyTag = document.createElement('rt');
     setTimeout(crash, 0);
 }
 window.addEventListener("load", insertNodes, false);
 </script>
 </head>
 <body>
 <p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=70171">70171</a>: Crash in RenderTableSection::splitColumn</p>
 <p> This test PASSES if it does not CRASH or ASSERT.</p>
 </body>
 </html>
	<!DOCTYPE html>
	<html>
	<head>
	<style>
	.lastTableHeaderGroup:last-of-type { display: table-header-group; }</style>
	</style>
	<script>
	if (window.testRunner) {
	testRunner.dumpAsText();
	testRunner.waitUntilDone();
	}

	function crash()
	{
	rubyTag.appendChild(lastTableHead);
	if (window.testRunner)
	testRunner.notifyDone();
	}

	function insertNodes() {
	var tableHead = document.createElement('th');
	tableHead.setAttribute('colspan', '5');
	tableHead.setAttribute('class', 'lastTableHeaderGroup');
	document.documentElement.appendChild(tableHead);
	tableHead.appendChild(document.createElement('p'));
	lastTableHead = document.createElement('th');
	document.documentElement.appendChild(lastTableHead);
	rubyTag = document.createElement('rt');
	setTimeout(crash, 0);
	}
	window.addEventListener("load", insertNodes, false);
	</script>
	</head>
	<body>
	<p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=70171">70171</a>: Crash in RenderTableSection::splitColumn</p>
	<p> This test PASSES if it does not CRASH or ASSERT.</p>
	</body>
	</html>