<!doctype html>
<html>
    <head>
        <style>
            #el0 {
                -webkit-flow-from: a;
                content: counter(c);
            }
            #el2 {
                -webkit-flow-into: a;
            }
        </style>
        <script>
            if (window.layoutTestController)
                layoutTestController.dumpAsText();

            function crash() {
                el0 = document.createElement('div');
                el0.setAttribute('id', 'el0');
                document.body.appendChild(el0);
                el1 = document.createElement('div');
                document.body.appendChild(el1);
                el2 = document.createElement('div');
                el2.setAttribute('id', 'el2');
                el1.appendChild(el2);
                el2.appendChild(document.createTextNode('A'));
                el3 = document.createElement('input');
                el3.setAttribute('id', 'el3');
                el2.appendChild(el3);
                document.body.style.zoom=2;
                document.execCommand('selectall');
                el2.style.display='table-header-group';
                document.body.style.zoom=1;
            }
            window.onload=crash
        </script>
    </head>
    <body>
        <p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=74781">74781</a>: Crash in RenderFlowThread::getRegionRangeForBox</p>
        <p> This test PASSES if it does not CRASH or ASSERT.</p>
    </body>
</html>