chromium/third_party/blink/web_tests/fast/multicol/dynamic/insert-spanner-after-abspos-subtree-crash.html

<!DOCTYPE html>
<p>Insert a spanner into a multicol, before regular content, after an absolutely positioned subtree.</p>
<p>PASS if no crash or assertion failure.</p>
<div style="-webkit-columns:3;">
    <div style="-webkit-column-span:all;"></div>
    <div style="position:absolute;">
        <div></div>
    </div>
    <div id="spanner" style="display:none; -webkit-column-span:all;"></div>
    <div></div>
    <div style="-webkit-column-span:all;"></div>
    <div></div>
</div>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();
    document.body.offsetTop;
    document.getElementById("spanner").style.display = "block";
</script>