chromium/third_party/blink/web_tests/fast/multicol/inline-children-crash.html

<!DOCTYPE html>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();
    onload = function() {
        document.getElementById('mc').offsetTop; // trigger layout
        document.getElementById('mc').style.webkitColumns = 'auto';
        document.getElementById('mc').style.columns = 'auto';
        document.getElementById('inline').style.color = 'green';
    }
</script>
<p>This test should not crash.</p>
<div id="mc" style="-webkit-columns:3; columns:3;">
    <span id="inline">PASS</span>
</div>