<!DOCTYPE html>
<html>
A<div></div>
<div id="div1"></div>
<style>
* { display: table-cell;  }
.class1 { -webkit-appearance: sliderthumb-vertical; }
</style>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

document.addEventListener("DOMContentLoaded", crash, false);
function crash() {
    div1 = document.getElementById("div1");
    div1.style.display = "table-row-group";
    document.documentElement.offsetTop;
    div1.setAttribute("class", "class1");
    document.documentElement.offsetTop;
    document.documentElement.innerHTML = "<a href='https://bugs.webkit.org/show_bug.cgi?id=94291'>94291</a>: Crash in RenderTableSection::setCellLogicalWidths<br/>This test has PASSED as it didn't CRASH or ASSERT.";
}
</script>
</html>