LayoutTests/fast/lists/remove-listmarker-from-anonblock-with-continuation-crash.html

<style>
.listItem { display: list-item; text-decoration: none; -webkit-column-width: 10px; }
.colSpanAll { display: block; -webkit-column-span: all; }
.absPosition { display: inherit; position: absolute; }
</style>
<script>
theadElement = document.createElement('thead');
theadElement.setAttribute('class', 'listItem');
document.documentElement.appendChild(theadElement);

listItemElement = document.createElement('li');
listItemElement.appendChild(document.createTextNode('PASS if no crash or assert in debug'));

theadElement.appendChild(listItemElement);
theadElement.appendChild(document.createElement('progress'));
theadElement.appendChild(document.createElement('hgroup'));

document.documentElement.offsetHeight;
listItemElement.setAttribute('class', 'absPosition');
document.documentElement.offsetHeight;
listItemElement.setAttribute('class', 'colSpanAll');

if (window.testRunner)
    testRunner.dumpAsText();
</script>