chromium/third_party/blink/web_tests/fast/multicol/dynamic/insert-spanner-after-inner-multicol-crash.html

<!DOCTYPE html>
<p>Insert a spanner right after an inner multicol container and before column content, splitting an existing column row.</p>
<p>PASS if no crash or assertion failure.</p>
<div style="-webkit-columns:3;">
    <div style="-webkit-columns:3;">
        &nbsp;
    </div>
    <div id="elm" style="display:none; -webkit-column-span:all;"></div>
    &nbsp;
    <div style="-webkit-column-span:all;"></div>
</div>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();
    onload = function() {
        document.body.offsetTop;
        document.getElementById("elm").style.display = "block";
    }
</script>