chromium/third_party/blink/web_tests/fast/dynamic/block-flow-split-crash.html

<!DOCTYPE html>
<style>
.maybe-colspan:nth-last-child(even) { -webkit-column-span: all; }
</style>
<script>
if (window.testRunner)
  testRunner.dumpAsText();
onload = function() {
  document.getElementById('container').appendChild(document.getElementById('fixed'));
}
</script>
Tests layer structure integrity when block flow is splitted and restructured dynamically.
Should not crash.
<div id="container" style="-webkit-column-count: 2">
  <div class="maybe-colspan"></div>
  <span class="maybe-colspan">
    <div></div>
  </span>
</div>
<div id="fixed" style="position: fixed"></div>