MSEdge: Type confusion in HandleColumnBreakOnColumnSpanningElement

Confirmed in IE.

MS Edge however doesn’t crash. It refuses to show the page, but the debugger shows what looks like a normal JavaScript exception during a JS function call. Edge catches that exception just fine.

> Microsoft Edge and 32-bit IE 11 should behave similarly

No, google, they should not. The two are almost completely different.

Live demo: http://const.me/tmp/test.html

Call stack from Edge: http://const.me/tmp/edge-stack.txt