Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/fast/multicol/dynamic/spanner-becomes-abspos-crash.html 

<!DOCTYPE html>
<p>Turn a column spanner into an absolutely positioned box.</p>
<p>PASS if no crash or assertion failure.</p>
<div style="-webkit-column-count:2;">
    Text.
    <div>
        <div id="spanner" style="-webkit-column-span:all;"></div>
    </div>
    Text.
    <span id="something" style="display:none;"></span>
</div>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();
    document.body.offsetTop;
    spanner.style.position = "absolute";

    // Trigger another layout pass, now that the spanner should be
    // gone. That element is now absolutely positioned, so it should
    // have lost its spanner capabilities, since the combination of
    // abspos and spanner isn't allowed.
    document.body.offsetTop;
    something.style.display = "inline";
</script>