chromium/third_party/blink/web_tests/fast/multicol/newmulticol/spanner-inside-child-crash.html

<!DOCTYPE html>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();
</script>
<div style="-webkit-columns:2; columns:2;">
    <div>
        <div style="-webkit-column-span:all; column-span:all;">PASS if no crash</div>
    </div>
</div>