Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/fast/multicol/span/table-row-group-crash.html 

<!DOCTYPE html>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();
</script>
<style>
#invalid-spanner { display:none; -webkit-column-span:all; }
</style>

Test passes if it does not CRASH.
<div style="-webkit-column-count:1;">
    <div>
        <span id="inline" style="display:none;"></span>
        <div id="invalid-spanner"></div>
    </div>
</div>

<script>
    document.body.offsetTop;
    document.getElementById("inline").style.display = "inline";

    // Note that a table-row-group isn't allowed to become a spanner.
    document.getElementById("invalid-spanner").style.display = "table-row-group";

    onload = function() {
        document.body.offsetTop;
        document.getElementById("invalid-spanner").style.webkitColumnSpan = "none";
    }
</script>