chromium/third_party/blink/web_tests/paint/clipath/change-mask-clip-path-multicol-crash.html

<!DOCTYPE html>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<script src="../../resources/run-after-layout-and-paint.js"></script>
<script>
async_test(t => {
  runAfterLayoutAndPaint(t.step_func_done(() => {
    target.textContent = '12345';
    target.style.webkitMask = 'url(#bar)';
    target.style.clipPath = 'url(#foo)';
  }));
});
</script>
<div style="columns: 2">
  <a id="target" style="clip-path: circle(70%); border-bottom: 2px solid"></a>
</div>