chromium/third_party/blink/web_tests/fragmentation/thead-paint-crash.html

<!DOCTYPE html>
<style>
.thead {
    break-inside:avoid-column;
    display:table-header-group;
}
.body{
    column-fill:auto;
    column-count:256;
    height: 600px;
}
</style>
<script src="../resources/check-layout.js"></script>
<body class="body" data-expected-height=600>
<table class="thead">
    <p class="thead"></p>
</table>
</body>
<script>
    checkLayout(".body");
</script>