LayoutTests/fast/inline/marquee-with-spanner-remove-crash.html

<span id=container>
  <marquee id=marquee>
    <span>PASS if no crash or assert.</span>
  </marquee>
  <div id=div></div>
</span>
<script>
window.testRunner?.dumpAsText();

document.body.offsetHeight;
div.style.columnSpan = "all";
div.getAnimations();
marquee.start();
container.remove();
</script>