chromium/third_party/blink/web_tests/fast/block/block-remove-child-delete-line-box-crash.html

<html>
<style>
div { -webkit-column-count:2; }
h1 { -webkit-column-span: all; }
</style>
<body>
<summary>
<div id="div1">
BeforeText<span id="span1">SpanText</span>AfterText
<p>ParaText</p>
</div>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

document.body.offsetTop;
var h1 = document.createElement('h1');
h1.appendChild(document.createTextNode('heading'));
div1.insertBefore(h1, span1);
</script>
</summary>
</body>
</html>