<!DOCTYPE html>
<p>crbug.com/588178: PASS if no crash or assertion failure.</p>
<div id="removeMe" style="float:left; width:100px; height:100px;"></div>
<div id="container">
    <!-- Sneak past removeFloatingObjectsFromDescendants() stuff in
             LayoutBoxModelObject::moveChildTo() during LayoutMultiColumnFlowThread::populate(),
                      by having a non-LayoutBlockFlow as the first child: -->
    <div style="display:table;"></div>
    <div>
        <div id="block2">
            <textarea id="block2" style="display:block;"></textarea>
        </div>
    </div>
</div>
<script>
if (window.testRunner)
    testRunner.dumpAsText();
document.body.offsetTop;
document.getElementById("container").style.columns = "2";
getComputedStyle(document.body);
document.getElementById("removeMe").style.display = "none";
document.getElementById("block2").style.webkitWritingMode = "vertical-lr";
</script>