<!DOCTYPE html>
<html>
<head>
<style>
    :after { display: table-cell; content: "Foo"; }
    :first-child { display: table-cell; }
    :before { display: table-column; content: "Bar"; }
</style>
<script type="text/javascript"> 
if (window.testRunner)
    testRunner.dumpAsText();

function crash(event) {
    newContent = document.createTextNode("Lorem Ipsum");
    var divElement = document.createElement("div");
    divElement.appendChild(newContent);
    divElement.appendChild(document.createElement("div"));
    document.getElementById("target").appendChild(divElement);

    // For some reason, DRT dumps the <style> so remove it here to clean the dump.
    var style = document.getElementsByTagName("style")[0];
    style.parentNode.removeChild(style);
}

window.addEventListener("load", crash, false)
</script>
</head>
<body id="target">
<p>Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=89496">89496</a>: Crash in RenderTableSection::addCell.</p>
<p>This test passes if it doesn't CRASH or ASSERT.</p>
</body>
</html>