<!DOCTYPE html>
<html>
<style>
.colContainer { -webkit-column-count: 0; }
.absolutePosition { position: absolute; }
.colSpanAll { -webkit-column-span: all; }
.transformed { transform: rotate(45deg); }
.hidden { display:none; }
.normal { display:block;}
</style>
<script>
window.onload = function() {
columnContainerBlock = document.createElement('div');
columnContainerBlock.setAttribute('class', 'colContainer');
document.documentElement.appendChild(columnContainerBlock);
splitBlockParent = document.createElement('div');
splitBlockParent.setAttribute('class', 'transformed');
columnContainerBlock.appendChild(splitBlockParent);
splitFlowDt = document.createElement('dt');
splitBlockParent.appendChild(splitFlowDt);
positionedDiv = document.createElement('div');
positionedDiv.setAttribute('class', 'absolutePosition');
splitBlockParent.appendChild(positionedDiv);
columnSpan = document.createElement('col');
columnSpan.setAttribute('class', 'colSpanAll');
splitFlowDt.appendChild(columnSpan); // Inserting the col inside the dt causes it to get split.
document.documentElement.offsetHeight;
splitFlowDt.setAttribute('class', 'hidden'); // This removes the split dt and the col from the render tree.
document.documentElement.offsetHeight;
splitFlowDt.setAttribute('class', 'normal'); // Re-adding the dt causes the flow to split again.
document.documentElement.offsetHeight;
splitBlockParent.removeChild(positionedDiv); // Remove the positioned object from the tree.
document.documentElement.offsetHeight;
splitBlockParent.removeChild(splitFlowDt); // Ensure the node with the bad positioned object list gets layout.
if (window.testRunner)
testRunner.dumpAsText();
}
</script>
<body>
PASS if no assert or crash in debug
</body>
</html>