chromium/third_party/blink/web_tests/fast/multicol/dynamic/spanner-change-multicol-writing-mode-crash.html

<!DOCTYPE html>
<div id="multicol" style="columns:2; writing-mode:vertical-rl;">
    <div>
        <div style="column-span:all;"></div>
    </div>
</div>
<script src="../../../resources/testharness.js"></script>
<script src="../../../resources/testharnessreport.js"></script>
<script>
test(() => {
    document.body.offsetTop;
    document.getElementById("multicol").style.writingMode = "horizontal-tb";
}, "No crash or assertion failure.");
</script>