chromium/third_party/blink/web_tests/fast/multicol/span/sole-svg-spanner-with-foreignObject-crash.html

<!DOCTYPE html>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();
</script>
<p>PASS if no crash or assertion failure.</p>
<div style="-webkit-column-count:2;">
    <svg style="display:block; -webkit-column-span:all;">
        <foreignObject style="overflow:visible">&nbsp;</foreignObject>
    </svg>
</div>