summaryrefslogtreecommitdiffstats
path: root/testing/web-platform/tests/css/css-multicol/crashtests
diff options
context:
space:
mode:
Diffstat (limited to 'testing/web-platform/tests/css/css-multicol/crashtests')
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/as-baseline-aligned-grid-item.html6
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/balance-with-forced-break.html13
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/balancing-flex-item-trailing-margin-freeze.html13
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/balancing-tall-borders-freeze.html8
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/body-becomes-spanner-html-becomes-vertical-rl.html12
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/break-before-multicol-caption.html12
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/chrome-bug-1293905.html19
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/chrome-bug-1297118.html12
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/chrome-bug-1301281.html22
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/chrome-bug-1303256.html9
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/chrome-bug-1314866.html5
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/dynamic-simplified-layout-break-propagation.html13
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/fit-content-with-spanner-and-auto-scrollbar-sibling.html11
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/float-becomes-non-float-spanner-surprises-inside.html14
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/float-becomes-spanner.html15
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/float-multicol-crash.html15
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/forced-break-in-oof-in-column-balancing-nested.html11
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/forced-break-in-oof-in-column-balancing.html11
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/inline-with-spanner-in-overflowed-container-before-multicol-float.html15
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/margin-and-break-before-child-spanner.html9
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/monolithic-oof-in-clipped-container.html8
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/move-linebreak-to-different-column.html19
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/move-newline-pre-text.html23
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/multicol-at-page-boundary-print.html12
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/multicol-block-in-inline-crash.html12
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/multicol-cached-consumed-bsize-crash.html15
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/multicol-column-change-crash.html19
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/multicol-dynamic-contain-crash.html37
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/multicol-dynamic-transform-crash.html31
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/multicol-floats-after-column-span-crash.html20
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/multicol-floats-in-ifc.html13
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/multicol-parallel-flow-after-spanner-in-inline.html13
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/multicol-table-caption-parallel-flow-after-spanner-in-inline.html15
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/multicol-with-monolithic-oof-with-multicol-with-oof.html10
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/negative-margin-on-column-spanner.html4
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/nested-as-balanced-legend.html12
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/nested-as-nested-balanced-legend.html12
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/nested-floated-multicol-with-tall-margin.html5
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-and-float-with-tall-padding-before-float.html7
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-and-float-with-tall-padding.html7
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-fieldset-tall-trailing-border-freeze.html12
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-fieldset-tall-trailing-padding.html12
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-in-svg-foreignobject.html12
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-nested-flex.html13
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-with-float-between.html10
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/nested-oof-multicol-with-monolithic-child.html12
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/nested-oof-multicol-with-oof-needing-additional-columns.html12
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/nested-oof-multicol-with-padding.html9
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/nested-spanner-with-negative-margin.html10
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/nested-with-fragmented-oof-negative-top-offset.html13
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/nested-with-multicol-table-caption.html11
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/nested-with-multicol-table-cell.html9
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/nested-with-oof-inside-fixed-width.html15
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/nested-with-percentage-size-and-oof.html10
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/nested-with-tall-padding-and-oof.html8
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/nested-with-tall-padding-and-spanner-and-content.html9
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/nested-with-tall-padding.html6
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/oof-becomes-spanner.html15
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/oof-in-additional-column-before-spanner.html22
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/oof-in-nested-line-float.html12
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/oof-nested-multicol-inside-oof.html14
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/outline-move-oof-with-inline.html14
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/relayout-nested-with-oof.html14
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/relpos-inline-with-abspos-multicol-gets-block-child.html14
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/relpos-spanner-with-spanner-child-becomes-regular.html14
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/remove-spanner-after-spanner-in-inline-before-inline.html16
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/remove-spanner-in-table-caption-nested-multicol.html18
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/repeated-section-in-nested-table-nested-multicol.html15
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/repeated-table-footer-in-caption-nested-multicol.html12
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/restricted-height-bottom-border-overflow-and-spanner.html11
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/scrollable-spanner-in-nested.html10
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/size-containment-become-multicol-add-inline-child.html12
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/spanner-after-parallel-flow.html16
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/spanner-in-inline-after-very-tall-content-001.html12
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/spanner-in-inline-after-very-tall-content-002.html14
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/spanner-in-overflowed-clipped-container.html10
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/spanner-in-overflowed-container-before-float.html13
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/spanner-in-overflowed-container-before-inline-content.html14
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/spanner-inside-inline-in-overflowed-container.html12
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/specified-height-with-just-spanner-and-oof.html7
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/sticky-in-abs-in-sticky.html11
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/table-caption-change-descendant-display-type.html16
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/table-caption-inline-block-remove-child.html19
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/table-cell-writing-mode-root.html10
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/trailing-parent-padding-between-spanners.html10
-rw-r--r--testing/web-platform/tests/css/css-multicol/crashtests/vertical-rl-column-rules-wide-columns.html6
86 files changed, 1105 insertions, 0 deletions
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/as-baseline-aligned-grid-item.html b/testing/web-platform/tests/css/css-multicol/crashtests/as-baseline-aligned-grid-item.html
new file mode 100644
index 0000000000..f9a9e1dad0
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/as-baseline-aligned-grid-item.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1349884">
+<div style="display:grid; justify-items:baseline;">
+ <div style="columns:0px; gap:100%;"></div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/balance-with-forced-break.html b/testing/web-platform/tests/css/css-multicol/crashtests/balance-with-forced-break.html
new file mode 100644
index 0000000000..794f761766
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/balance-with-forced-break.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1372653">
+<div style="columns:2;">
+ <div>
+ <div style="display:flow-root;"></div>
+ <div style="break-before:column; margin-bottom:100px;"></div>
+ </div>
+ <div>
+ <div style="display:flow-root;"></div>
+ <div style="break-before:column;"></div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/balancing-flex-item-trailing-margin-freeze.html b/testing/web-platform/tests/css/css-multicol/crashtests/balancing-flex-item-trailing-margin-freeze.html
new file mode 100644
index 0000000000..3cbf2f853e
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/balancing-flex-item-trailing-margin-freeze.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1395408">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1399449">
+<div style="columns:2;">
+ <div style="contain:size; height:40px;">PASS if no freeze.</div>
+ <div style="display:flex;">
+ <div style="contain:size; margin-bottom:2px; height:30px; width:100px;"></div>
+ </div>
+ <div style="display:flex;">
+ <div style="contain:size; margin-bottom:2px; height:30px; width:100px;"></div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/balancing-tall-borders-freeze.html b/testing/web-platform/tests/css/css-multicol/crashtests/balancing-tall-borders-freeze.html
new file mode 100644
index 0000000000..2672690669
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/balancing-tall-borders-freeze.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1395408">
+<div style="columns:2;">
+ <div style="contain:size; height:40px;">PASS if no freeze.</div>
+ <div style="display:flow-root; border-top:32px solid;"></div>
+ <div style="display:flow-root; border-top:32px solid;"></div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/body-becomes-spanner-html-becomes-vertical-rl.html b/testing/web-platform/tests/css/css-multicol/crashtests/body-becomes-spanner-html-becomes-vertical-rl.html
new file mode 100644
index 0000000000..7cd544b71c
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/body-becomes-spanner-html-becomes-vertical-rl.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1377673">
+<style>
+ html { columns:2; }
+</style>
+<div style="height:100px;"></div>
+<script>
+ document.body.offsetTop;
+ document.body.style.columnSpan = "all";
+ document.documentElement.style.writingMode = "vertical-rl";
+</script>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/break-before-multicol-caption.html b/testing/web-platform/tests/css/css-multicol/crashtests/break-before-multicol-caption.html
new file mode 100644
index 0000000000..ac6f444eaa
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/break-before-multicol-caption.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1375029">
+<div style="columns:5; column-fill:auto; height:10px;">
+ <div style="display:table;">
+ <div style="display:table-caption;">
+ <div style="height:1px;"></div>
+ <div style="height:11px; contain:size;"></div>
+ </div>
+ <div style="display:table-caption; columns:2; column-fill:auto; height:1px;"></div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/chrome-bug-1293905.html b/testing/web-platform/tests/css/css-multicol/crashtests/chrome-bug-1293905.html
new file mode 100644
index 0000000000..2f1bd84528
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/chrome-bug-1293905.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1293905">
+<div style="columns:1;">
+ <div style="columns:1; position:absolute;">
+ <div style="position:absolute;">
+ <div style="position:fixed;"></div>
+ <div style="appearance:searchfield; columns:1; background-image:url(not-found); width:100px; height:100px;"></div>
+ </div>
+ <div id="boo" style="display:none;"></div>
+ </div>
+</div>
+<script>
+ document.body.offsetTop;
+ function boom() {
+ boo.style.display = "block";
+ }
+ window.addEventListener("load", boom);
+</script>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/chrome-bug-1297118.html b/testing/web-platform/tests/css/css-multicol/crashtests/chrome-bug-1297118.html
new file mode 100644
index 0000000000..5c96614db2
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/chrome-bug-1297118.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1297118">
+<div style="columns:2;">
+ <div style="columns:2;">
+ <div style="column-span:all;">
+ <span style="position:relative;">
+ <div style="display:flex; float:right;"></div>
+ </span>
+ </div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/chrome-bug-1301281.html b/testing/web-platform/tests/css/css-multicol/crashtests/chrome-bug-1301281.html
new file mode 100644
index 0000000000..0c34e08890
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/chrome-bug-1301281.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+ <link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+ <link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1301281">
+ <div style="columns:2; column-fill:auto; height:30px; line-height:20px; width:fit-content;">
+ <span><span id="first"></span><input style="float:right; padding:3%;"></span>
+ </div>
+ <script>
+ requestAnimationFrame(()=> {
+ requestAnimationFrame(()=> {
+ first.innerHTML = "D";
+ document.body.offsetTop;
+ requestAnimationFrame(()=> {
+ requestAnimationFrame(()=> {
+ document.body.style.color = "blue";
+ document.documentElement.classList.remove("reftest-wait");
+ });
+ });
+ });
+ });
+ </script>
+</html>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/chrome-bug-1303256.html b/testing/web-platform/tests/css/css-multicol/crashtests/chrome-bug-1303256.html
new file mode 100644
index 0000000000..072af7d4ef
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/chrome-bug-1303256.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1303256">
+<div style="columns:2; column-fill:auto; height:100px;">
+ <div style="break-inside:avoid; width:100px; height:100px;"></div>
+ <div style="columns:2; column-fill:auto; height:50px;">
+ <div style="columns:2; margin:8px; column-fill:auto; height:1px;"></div>
+ <div style="columns:2; column-fill:auto; height:1px;"></div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/chrome-bug-1314866.html b/testing/web-platform/tests/css/css-multicol/crashtests/chrome-bug-1314866.html
new file mode 100644
index 0000000000..538586ab5d
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/chrome-bug-1314866.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1314866">
+<div style="columns:2; line-height:1px;">
+ <div style="columns:2; column-fill:auto; height:20px; padding-top:9px;">x</div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/dynamic-simplified-layout-break-propagation.html b/testing/web-platform/tests/css/css-multicol/crashtests/dynamic-simplified-layout-break-propagation.html
new file mode 100644
index 0000000000..c675b50f94
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/dynamic-simplified-layout-break-propagation.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<body style="columns: 1;">
+ <div style="display: inline-block; position: relative;">
+ <div style="position: absolute;">
+ <div id="target"></div>
+ </div>
+ <div style="break-before: column;"></div>
+ </div>
+</body>
+<script>
+document.body.offsetTop;
+document.getElementById('target').style.height = '10px';
+</script>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/fit-content-with-spanner-and-auto-scrollbar-sibling.html b/testing/web-platform/tests/css/css-multicol/crashtests/fit-content-with-spanner-and-auto-scrollbar-sibling.html
new file mode 100644
index 0000000000..105da399b1
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/fit-content-with-spanner-and-auto-scrollbar-sibling.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1308960">
+<div style="columns:2; width:100px;">
+ <div style="width:min-content;">
+ <div style="column-span:all;"></div>
+ <div style="height:50px; overflow:auto;">
+ <div style="width:100px; height:100px;"></div>
+ </div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/float-becomes-non-float-spanner-surprises-inside.html b/testing/web-platform/tests/css/css-multicol/crashtests/float-becomes-non-float-spanner-surprises-inside.html
new file mode 100644
index 0000000000..39fccf4522
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/float-becomes-non-float-spanner-surprises-inside.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1373409">
+<div style="columns:2;">
+ <div id="elm" style="margin-bottom:100px; float:left;">
+ <div style="column-span:all;"></div>
+ <div style="column-span:all;"></div>
+ </div>
+</div>
+<script>
+ document.body.offsetTop;
+ elm.style.cssFloat = "none";
+ elm.offsetTop;
+</script>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/float-becomes-spanner.html b/testing/web-platform/tests/css/css-multicol/crashtests/float-becomes-spanner.html
new file mode 100644
index 0000000000..90a4c9079c
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/float-becomes-spanner.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1317656">
+<div style="columns:2;">
+ <div>
+ <div id="elm" style="float:left;"></div>
+ </div>
+</div>
+<script>
+ document.body.offsetTop;
+ elm.style.cssFloat = "none";
+ elm.style.columnSpan = "all";
+ document.body.offsetTop;
+ elm.style.display = "none";
+</script>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/float-multicol-crash.html b/testing/web-platform/tests/css/css-multicol/crashtests/float-multicol-crash.html
new file mode 100644
index 0000000000..a8f01db169
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/float-multicol-crash.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<style>
+#htmlvar00001 {
+ shape-outside: inset(-1px 8px 1px 1px);
+}
+
+* {
+ font-size: 1px;
+ float: right;
+ column-width: 7px;
+}
+</style>
+<select id="htmlvar00001" size="1"></select>
+<wbr>
+<span contenteditable="true"></span>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/forced-break-in-oof-in-column-balancing-nested.html b/testing/web-platform/tests/css/css-multicol/crashtests/forced-break-in-oof-in-column-balancing-nested.html
new file mode 100644
index 0000000000..02b3295444
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/forced-break-in-oof-in-column-balancing-nested.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1322319">
+<div style="columns:2;">
+ <div style="columns:2; position:relative; column-fill:auto; height:10px;">
+ <div style="position:absolute;">
+ <div></div>
+ <div style="break-before:column;"></div>
+ </div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/forced-break-in-oof-in-column-balancing.html b/testing/web-platform/tests/css/css-multicol/crashtests/forced-break-in-oof-in-column-balancing.html
new file mode 100644
index 0000000000..31cafba9a2
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/forced-break-in-oof-in-column-balancing.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1322319">
+<div style="columns:2;">
+ <div style="position:relative; height:10px;">
+ <div style="position:absolute;">
+ <div style="height:1px;"></div>
+ <div style="break-before:column;"></div>
+ </div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/inline-with-spanner-in-overflowed-container-before-multicol-float.html b/testing/web-platform/tests/css/css-multicol/crashtests/inline-with-spanner-in-overflowed-container-before-multicol-float.html
new file mode 100644
index 0000000000..69abc9bcf9
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/inline-with-spanner-in-overflowed-container-before-multicol-float.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1309859">
+<div style="columns:2;">
+ <div style="height:10px;"></div>
+ <span>
+ <div style="height:20px;">
+ <div style="display:inline-block; width:10px; height:50px;"></div>
+ <div>
+ <div style="column-span:all;"></div>
+ </div>
+ </div>
+ </span>
+ <div style="columns:2; height:100px; float:left;"></div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/margin-and-break-before-child-spanner.html b/testing/web-platform/tests/css/css-multicol/crashtests/margin-and-break-before-child-spanner.html
new file mode 100644
index 0000000000..8ec36250cf
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/margin-and-break-before-child-spanner.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1380371">
+<div style="columns:3; column-fill:auto; height:106px;">
+ <div style="margin-top:10px;">
+ <div style="float:left; width:10px; padding-bottom:100px;"></div>
+ <div style="column-span:all;"></div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/monolithic-oof-in-clipped-container.html b/testing/web-platform/tests/css/css-multicol/crashtests/monolithic-oof-in-clipped-container.html
new file mode 100644
index 0000000000..7a35062902
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/monolithic-oof-in-clipped-container.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1403467">
+<div style="columns:2; column-fill:auto; height:250px;">
+ <div style="position:relative; overflow:clip; width:100px; height:100px;">
+ <div style="position:absolute; contain:size; width:100px; height:100px;"></div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/move-linebreak-to-different-column.html b/testing/web-platform/tests/css/css-multicol/crashtests/move-linebreak-to-different-column.html
new file mode 100644
index 0000000000..abe83ca194
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/move-linebreak-to-different-column.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+ <link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+ <link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1322739">
+ <div id="container">
+ <div id="mc" style="height:100px; columns:2; column-fill:auto; line-height:20px; orphans:1; widows:1;">
+ <br><br><br><br><br><br>
+ </div>
+ </div>
+ <script>
+ requestAnimationFrame(()=> {
+ requestAnimationFrame(()=> {
+ mc.style.height = "80px";
+ container.setAttribute("ontouchstart", "nonValidFunctionName()");
+ document.documentElement.classList.remove("reftest-wait");
+ });
+ });
+ </script>
+</html>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/move-newline-pre-text.html b/testing/web-platform/tests/css/css-multicol/crashtests/move-newline-pre-text.html
new file mode 100644
index 0000000000..13833ae946
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/move-newline-pre-text.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+ <link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+ <link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1386676">
+ <div id="container" style="columns:10; column-fill:auto; height:30px; line-height:20px; orphans:1; widows:1; white-space:pre;">
+ <span id="htmlvar00001"><br><br></span>
+
+</div>
+ <script>
+ requestAnimationFrame(()=> {
+ requestAnimationFrame(()=> {
+ document.body.style.color = "blue";
+ htmlvar00001.style.display = "none";
+ requestAnimationFrame(()=> {
+ requestAnimationFrame(()=> {
+ container.style.width = "88%";
+ document.documentElement.classList.remove("reftest-wait");
+ });
+ });
+ });
+ });
+ </script>
+</html>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/multicol-at-page-boundary-print.html b/testing/web-platform/tests/css/css-multicol/crashtests/multicol-at-page-boundary-print.html
new file mode 100644
index 0000000000..63b27c88cd
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/multicol-at-page-boundary-print.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1383662">
+<style>
+ body {
+ margin: 0;
+ }
+</style>
+<div style="height:100vh;"></div>
+<div style="columns:2;">
+ <div style="padding-top:100px;"></div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/multicol-block-in-inline-crash.html b/testing/web-platform/tests/css/css-multicol/crashtests/multicol-block-in-inline-crash.html
new file mode 100644
index 0000000000..037b558ac0
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/multicol-block-in-inline-crash.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<style type="text/css">
+body {
+ column-count: 5
+}
+</style>
+<body>
+ aaaaa aaaaaaaaaaaaaa aaaaaaaaaaaaaaa aaaaaaaaaa
+ <time><header><id>a
+ <p><div style="float: left"></div>aaaaa</p>
+ a<menu></menu>aaaaa aaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaa aaaaaaa
+</body>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/multicol-cached-consumed-bsize-crash.html b/testing/web-platform/tests/css/css-multicol/crashtests/multicol-cached-consumed-bsize-crash.html
new file mode 100644
index 0000000000..f82bddfef1
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/multicol-cached-consumed-bsize-crash.html
@@ -0,0 +1,15 @@
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1715098">
+<style>
+:not(table) {
+ column-width: 0;
+ margin-right: 91%;
+}
+#a {
+ column-span: all;
+ display: -webkit-box;
+}
+</style>
+<textarea>a</textarea>
+<del>a</del>
+<q style="float: left">a</q>
+<br id="a"></br>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/multicol-column-change-crash.html b/testing/web-platform/tests/css/css-multicol/crashtests/multicol-column-change-crash.html
new file mode 100644
index 0000000000..6f0a05be29
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/multicol-column-change-crash.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html class=test-wait>
+<div id="outer" style="column-count: 100;">
+ <div id="inner" style="transform: translateY(1px); height:300px;"></div>
+ <div id="changeme" style="padding: 100px;"></div>
+</div>
+<script>
+ requestAnimationFrame(function() {
+ requestAnimationFrame(function() {
+ changeme.style.padding = '0';
+ requestAnimationFrame(function() {
+ requestAnimationFrame(function() {
+ document.documentElement.classList.remove('test-wait');
+ });
+ });
+ });
+ });
+</script>
+</html>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/multicol-dynamic-contain-crash.html b/testing/web-platform/tests/css/css-multicol/crashtests/multicol-dynamic-contain-crash.html
new file mode 100644
index 0000000000..e20a6e70e3
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/multicol-dynamic-contain-crash.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<link rel="author" title="Koji Ishii" href="mailto:kojii@chromium.org">
+<link rel="help" href="https://crbug.com/965639">
+<style>
+#multicol {
+ columns: 2;
+ column-fill: auto;
+ height: 50px;
+ background: orange;
+}
+#container {
+ contain: strict;
+ width: 100px;
+ height: 100px;
+ background: blue;
+}
+#target {
+ width: 100px;
+ height: 100px;
+ position: absolute;
+ background: purple;
+}
+.transform {
+ transform: translate(0, 50px);
+}
+</style>
+<body>
+ <div id="multicol">
+ <div id="container">
+ <div id="target"></div>
+ </div>
+ </div>
+<script>
+document.body.offsetTop;
+target.appendChild(document.createTextNode('a'));
+</script>
+</body>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/multicol-dynamic-transform-crash.html b/testing/web-platform/tests/css/css-multicol/crashtests/multicol-dynamic-transform-crash.html
new file mode 100644
index 0000000000..993bd1eddd
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/multicol-dynamic-transform-crash.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<link rel="author" title="Koji Ishii" href="mailto:kojii@chromium.org">
+<link rel="help" href="https://crbug.com/965639">
+<style>
+#container {
+ columns: 2;
+ column-fill: auto;
+ background: orange;
+ height: 50px;
+}
+#target {
+ width: 100px;
+ height: 100px;
+ background: purple;
+ position: absolute;
+}
+.transform {
+ transform: translate(0, 50px);
+}
+</style>
+<body>
+ <div id="container">
+ <div style="position: relative">
+ <div id="target"></div>
+ </div>
+ </div>
+<script>
+document.body.offsetTop;
+target.classList.add('transform');
+</script>
+</body>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/multicol-floats-after-column-span-crash.html b/testing/web-platform/tests/css/css-multicol/crashtests/multicol-floats-after-column-span-crash.html
new file mode 100644
index 0000000000..4fe3f363eb
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/multicol-floats-after-column-span-crash.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html id="a">
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1674011">
+
+<style>
+:not(animateTransform) { columns: 1px }
+</style>
+<script>
+function go() {
+ a.appendChild(b)
+}
+function eh() {
+ a.appendChild(c)
+}
+</script>
+<body onload=go()>
+<data id="b">x</command>
+<dir style="column-span: all">x</dir>
+<details id="c" ontoggle="eh()" open="">x</details>
+<iframe align="right">x</iframe>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/multicol-floats-in-ifc.html b/testing/web-platform/tests/css/css-multicol/crashtests/multicol-floats-in-ifc.html
new file mode 100644
index 0000000000..63d1653049
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/multicol-floats-in-ifc.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<link rel="author" title="Koji Ishii" href="mailto:kojii@chromium.org">
+<link rel="help" href="https://crbug.com/1283250">
+<div style="columns:2; column-fill:auto; height:10px; line-height:20px;">
+ <div style="columns:1;">
+ <div style="padding-top:1px; direction:rtl;">
+ <span>
+ <div style="display:inline-block; width:101%; height:1px;"></div>
+ </span>
+ <div style="float:left; width:1px; height:1px;"></div>
+ </div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/multicol-parallel-flow-after-spanner-in-inline.html b/testing/web-platform/tests/css/css-multicol/crashtests/multicol-parallel-flow-after-spanner-in-inline.html
new file mode 100644
index 0000000000..2c0981239b
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/multicol-parallel-flow-after-spanner-in-inline.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1417514">
+<div style="columns:3; column-fill:auto; height:64px;">
+ <span>
+ <div style="column-span:all; height:50px;"></div>
+ <div style="height:13px; padding-top:1px;">
+ <div style="columns:2; padding-bottom:5px;">
+ <div style="contain:size; width:1px; height:20px;"></div>
+ </div>
+ </div>
+ </span>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/multicol-table-caption-parallel-flow-after-spanner-in-inline.html b/testing/web-platform/tests/css/css-multicol/crashtests/multicol-table-caption-parallel-flow-after-spanner-in-inline.html
new file mode 100644
index 0000000000..8de7e2f0d8
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/multicol-table-caption-parallel-flow-after-spanner-in-inline.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1417514">
+<div style="columns:2; column-fill:auto; height:100px;">
+ <span>
+ <div style="column-span:all; height:86px;"></div>
+ <div style="height:13px; padding-top:1px;">
+ <table style="padding-bottom:3px;">
+ <caption style="columns:2;">
+ <div style="contain:size; width:1px; height:20px;"></div>
+ </caption>
+ </table>
+ </div>
+ </span>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/multicol-with-monolithic-oof-with-multicol-with-oof.html b/testing/web-platform/tests/css/css-multicol/crashtests/multicol-with-monolithic-oof-with-multicol-with-oof.html
new file mode 100644
index 0000000000..43133fc233
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/multicol-with-monolithic-oof-with-multicol-with-oof.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1314492">
+<div style="columns:2;">
+ <div style="position:absolute; contain:size;">
+ <div style="columns:2;">
+ <div style="position:absolute;"></div>
+ </div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/negative-margin-on-column-spanner.html b/testing/web-platform/tests/css/css-multicol/crashtests/negative-margin-on-column-spanner.html
new file mode 100644
index 0000000000..0e14943d01
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/negative-margin-on-column-spanner.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<div style="columns: 2;">
+ <div style="margin: -100px; column-span: all;"></div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/nested-as-balanced-legend.html b/testing/web-platform/tests/css/css-multicol/crashtests/nested-as-balanced-legend.html
new file mode 100644
index 0000000000..72779dc3f3
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/nested-as-balanced-legend.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1308080">
+<div id="outer" style="columns:3; width:500px; height:200px; column-fill:auto;">
+ <legend style="columns:1;">
+ <div style="width:100px; height:100px;"></div>
+ </legend>
+</div>
+<script>
+ document.body.offsetTop;
+ outer.style.width = "501px";
+</script>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/nested-as-nested-balanced-legend.html b/testing/web-platform/tests/css/css-multicol/crashtests/nested-as-nested-balanced-legend.html
new file mode 100644
index 0000000000..0575193c21
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/nested-as-nested-balanced-legend.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1308024">
+<div id="outer" style="columns:3; width:500px;">
+ <legend style="columns:1;">
+ <div style="width:100px; height:100px;"></div>
+ </legend>
+</div>
+<script>
+ document.body.offsetTop;
+ outer.style.width = "501px";
+</script>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/nested-floated-multicol-with-tall-margin.html b/testing/web-platform/tests/css/css-multicol/crashtests/nested-floated-multicol-with-tall-margin.html
new file mode 100644
index 0000000000..93dc644d05
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/nested-floated-multicol-with-tall-margin.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1322125">
+<div style="columns:2; column-fill:auto; height:99px;">
+ <div style="float:left; margin-top:100px; column-fill:auto; height:10px;"></div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-and-float-with-tall-padding-before-float.html b/testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-and-float-with-tall-padding-before-float.html
new file mode 100644
index 0000000000..2a901d1f58
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-and-float-with-tall-padding-before-float.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1289532">
+<div style="columns:4; column-fill:auto; height:40px;">
+ <div style="float:left; width:100%; height:100px; padding-bottom:3000px;"></div>
+ <div style="float:left; columns:1; column-fill:auto; width:100%; height:100px;"></div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-and-float-with-tall-padding.html b/testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-and-float-with-tall-padding.html
new file mode 100644
index 0000000000..8eabef27f4
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-and-float-with-tall-padding.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1289532">
+<div style="columns:4; column-fill:auto; height:100px;">
+ <div style="float:left; height:10px; padding-bottom:100px; width:100%;"></div>
+ <div style="columns:2; column-fill:auto; height:200px; width:100%;"></div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-fieldset-tall-trailing-border-freeze.html b/testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-fieldset-tall-trailing-border-freeze.html
new file mode 100644
index 0000000000..014073a9e8
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-fieldset-tall-trailing-border-freeze.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1323250">
+<div style="columns:2; height:100px; column-fill:auto;">
+ <div style="height:10px;"></div>
+ <div style="columns:1; height:100px; column-fill:auto;">
+ <fieldset style="height:100px; border:none; padding:0; margin:0; border:1px solid; padding-bottom:19px;">
+ <legend style="padding:0; margin:0;"></legend>
+ <div></div>
+ </fieldset>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-fieldset-tall-trailing-padding.html b/testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-fieldset-tall-trailing-padding.html
new file mode 100644
index 0000000000..b155a4d7f4
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-fieldset-tall-trailing-padding.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1318137">
+<div style="columns:2; height:100px; column-fill:auto;">
+ <div style="height:10px;"></div>
+ <div style="columns:1; height:100px; column-fill:auto;">
+ <fieldset style="height:100px; border:none; padding:0; margin:0; padding-top:1px; padding-bottom:20px;">
+ <legend></legend>
+ x
+ </fieldset>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-in-svg-foreignobject.html b/testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-in-svg-foreignobject.html
new file mode 100644
index 0000000000..b182f534d4
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-in-svg-foreignobject.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1339391">
+<div style="columns:2;">
+ <svg>
+ <foreignObject>
+ <div style="columns:2;">
+ <div style="height:100px;"></div>
+ </div>
+ </foreignObject>
+ </svg>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-nested-flex.html b/testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-nested-flex.html
new file mode 100644
index 0000000000..047f0ac65e
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-nested-flex.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1376859">
+<div style="columns:3; column-fill:auto; height:20px;">
+ <div style="height:10px;"></div>
+ <div style="display:flex;">
+ <div style="display:flex; margin-top:15px;">
+ <div>
+ <div style="columns:2;"></div>
+ </div>
+ </div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-with-float-between.html b/testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-with-float-between.html
new file mode 100644
index 0000000000..3a583ed0da
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/nested-multicol-with-float-between.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1303662">
+<div style="columns:3; column-fill:auto; height:100px;">
+ <div style="height:70px;"></div>
+ <div style="float:left; break-inside:avoid; width:100%; height:200px;"></div>
+ <div style="columns:1; column-fill:auto; width:100%; height:50px;">
+ <div style="height:40px;"></div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/nested-oof-multicol-with-monolithic-child.html b/testing/web-platform/tests/css/css-multicol/crashtests/nested-oof-multicol-with-monolithic-child.html
new file mode 100644
index 0000000000..bf7aa425b6
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/nested-oof-multicol-with-monolithic-child.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1306582">
+<div style="columns:4; column-fill:auto; height:100px;">
+ <div style="position:relative;">
+ <div style="height:90px;"></div>
+ <div style="position:absolute; columns:1; column-fill:auto; width:10px; height:95px;">
+ <div style="height:95px; contain:size;"></div>
+ </div>
+ <div style="position:absolute; width:1px; height:100px;"></div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/nested-oof-multicol-with-oof-needing-additional-columns.html b/testing/web-platform/tests/css/css-multicol/crashtests/nested-oof-multicol-with-oof-needing-additional-columns.html
new file mode 100644
index 0000000000..52c44ff9e0
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/nested-oof-multicol-with-oof-needing-additional-columns.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1302323">
+<div style="columns:1; column-fill:auto; height:100px;">
+ <div style="position:relative;">
+ <div style="position:absolute; columns:1;">
+ <div style="position:relative; margin-top:101px;">
+ <div style="position:absolute; margin-top:101px;"></div>
+ </div>
+ </div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/nested-oof-multicol-with-padding.html b/testing/web-platform/tests/css/css-multicol/crashtests/nested-oof-multicol-with-padding.html
new file mode 100644
index 0000000000..e479758174
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/nested-oof-multicol-with-padding.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1306582">
+<div style="columns:2; column-fill:auto; height:100px;">
+ <div style="position:relative;">
+ <div style="height:90px;"></div>
+ <div style="position:absolute; columns:2; padding-top:40px;"></div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/nested-spanner-with-negative-margin.html b/testing/web-platform/tests/css/css-multicol/crashtests/nested-spanner-with-negative-margin.html
new file mode 100644
index 0000000000..3a9b2e354c
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/nested-spanner-with-negative-margin.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1321365">
+<div style="columns:2; column-fill:auto; height:20px;">
+ <div style="height:20px;"></div>
+ <div style="columns:1;">
+ <div style="column-span:all; margin-bottom:-3px;"></div>
+ <div style="height:10px;"></div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/nested-with-fragmented-oof-negative-top-offset.html b/testing/web-platform/tests/css/css-multicol/crashtests/nested-with-fragmented-oof-negative-top-offset.html
new file mode 100644
index 0000000000..38f62888a6
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/nested-with-fragmented-oof-negative-top-offset.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1311398">
+<div style="columns:2; column-fill:auto; height:100px;">
+ <div style="height:101px;"></div>
+ <div style="position:relative;">
+ <div style="columns:2; column-fill:auto;">
+ <div style="position:absolute; top:-50px;">
+ <div style="height:100px;"></div>
+ </div>
+ </div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/nested-with-multicol-table-caption.html b/testing/web-platform/tests/css/css-multicol/crashtests/nested-with-multicol-table-caption.html
new file mode 100644
index 0000000000..7ef78394e6
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/nested-with-multicol-table-caption.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1347141">
+<div style="columns:3; column-fill:auto; height:100px;">
+ <div style="height:100px;"></div>
+ <div style="display:table;">
+ <div style="display:table-caption; columns:2;">
+ Blargh, I'm dead!
+ </div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/nested-with-multicol-table-cell.html b/testing/web-platform/tests/css/css-multicol/crashtests/nested-with-multicol-table-cell.html
new file mode 100644
index 0000000000..abb99c6201
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/nested-with-multicol-table-cell.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1347322">
+<div style="columns:2;">
+ <div style="columns:2; margin-top:8px;">
+ text
+ <div style="display:table-cell; columns:2;"></div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/nested-with-oof-inside-fixed-width.html b/testing/web-platform/tests/css/css-multicol/crashtests/nested-with-oof-inside-fixed-width.html
new file mode 100644
index 0000000000..d53286ebe9
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/nested-with-oof-inside-fixed-width.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1303905">
+<div id="outer" style="columns:2; column-fill:auto; height:20px; width:100px;">
+ <div style="position:relative; columns:2; column-fill:auto;">
+ <div style="width:10px; position:relative;">
+ <div style="position:absolute; right:0; bottom:0;"></div>
+ </div>
+ <div style="position:absolute;"></div>
+ </div>
+</div>
+<script>
+ document.body.offsetTop;
+ outer.style.width = "101px";
+</script>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/nested-with-percentage-size-and-oof.html b/testing/web-platform/tests/css/css-multicol/crashtests/nested-with-percentage-size-and-oof.html
new file mode 100644
index 0000000000..bf53cc17f3
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/nested-with-percentage-size-and-oof.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1302592">
+<div style="columns:2;">
+ <div style="columns:2; width:100%;">
+ <div style="position:relative;">
+ <div style="position:absolute;"></div>
+ </div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/nested-with-tall-padding-and-oof.html b/testing/web-platform/tests/css/css-multicol/crashtests/nested-with-tall-padding-and-oof.html
new file mode 100644
index 0000000000..a055124257
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/nested-with-tall-padding-and-oof.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1295998">
+<div id="outer" style="columns:2; column-fill:auto; height:50px;">
+ <div id="inner" style="columns:2; padding-top:51px; column-fill:auto; height:1px;">
+ <div style="position:absolute;"></div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/nested-with-tall-padding-and-spanner-and-content.html b/testing/web-platform/tests/css/css-multicol/crashtests/nested-with-tall-padding-and-spanner-and-content.html
new file mode 100644
index 0000000000..cca75d461c
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/nested-with-tall-padding-and-spanner-and-content.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1308937">
+<div style="columns:2; height:100px;">
+ <div style="columns:2; padding-top:101px;">
+ <div style="column-span:all;"></div>
+ <div></div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/nested-with-tall-padding.html b/testing/web-platform/tests/css/css-multicol/crashtests/nested-with-tall-padding.html
new file mode 100644
index 0000000000..7f062b1ef9
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/nested-with-tall-padding.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1308937">
+<div style="columns:2; height:100px;">
+ <div style="columns:2; padding-top:101px;"></div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/oof-becomes-spanner.html b/testing/web-platform/tests/css/css-multicol/crashtests/oof-becomes-spanner.html
new file mode 100644
index 0000000000..4897e47dbc
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/oof-becomes-spanner.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1317656">
+<div style="columns:2;">
+ <div>
+ <div id="elm" style="position:absolute;"></div>
+ </div>
+</div>
+<script>
+ document.body.offsetTop;
+ elm.style.position = "static";
+ elm.style.columnSpan = "all";
+ document.body.offsetTop;
+ elm.style.display = "none";
+</script>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/oof-in-additional-column-before-spanner.html b/testing/web-platform/tests/css/css-multicol/crashtests/oof-in-additional-column-before-spanner.html
new file mode 100644
index 0000000000..afdeabe174
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/oof-in-additional-column-before-spanner.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+ <link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+ <link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1361902">
+ <div style="columns:1;">
+ <div style="float:left; padding-top:10px; position:relative;">
+ <div style="position:absolute; height:2px;"></div>
+ <div id="elm" style="display:inline-block;"></div>
+ </div>
+ <span>
+ <div style="column-span:all;"></div>
+ </span>
+ </div>
+ <script>
+ requestAnimationFrame(()=>{
+ requestAnimationFrame(()=>{
+ elm.style.display = "none";
+ document.documentElement.classList.remove("reftest-wait");
+ });
+ });
+ </script>
+</html>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/oof-in-nested-line-float.html b/testing/web-platform/tests/css/css-multicol/crashtests/oof-in-nested-line-float.html
new file mode 100644
index 0000000000..d4d67763c8
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/oof-in-nested-line-float.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1307990">
+<div style="columns:3; column-fill:auto; height:100px; line-height:20px; orphans:1; widows:1;">
+ <br>
+ <div style="columns:2; float:left; height:20px; column-fill:auto;">
+ <div style="position:relative;">
+ <br>
+ <div style="position:absolute; width:100%; height:10px;"></div>
+ </div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/oof-nested-multicol-inside-oof.html b/testing/web-platform/tests/css/css-multicol/crashtests/oof-nested-multicol-inside-oof.html
new file mode 100644
index 0000000000..f80225a5c8
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/oof-nested-multicol-inside-oof.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1320787">
+<div style="columns:3; height:30px; column-fill:auto; width:500px;">
+ <div style="position:relative; columns:2; height:20px; column-fill:auto; width:5px;">
+ <div style="position:absolute; height:200px; width:4px;">
+ <div style="columns:2; position:absolute; column-fill:auto; height:114px; width:3px;">
+ <div style="position:relative; width:2px;">
+ <div style="position:absolute; width:1px; height:50px;"></div>
+ </div>
+ </div>
+ </div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/outline-move-oof-with-inline.html b/testing/web-platform/tests/css/css-multicol/crashtests/outline-move-oof-with-inline.html
new file mode 100644
index 0000000000..f2b259bcf5
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/outline-move-oof-with-inline.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1374625">
+<div style="columns:2; column-fill:auto; outline-style:auto; height:100px;">
+ <div style="position:relative;">
+ <div id="dings" style="position:absolute; height:120px; left:10px;">
+ <span style="border:solid;">a</span>
+ </div>
+ </div>
+</div>
+<script>
+ document.body.offsetTop;
+ dings.style.left = "11px";
+</script>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/relayout-nested-with-oof.html b/testing/web-platform/tests/css/css-multicol/crashtests/relayout-nested-with-oof.html
new file mode 100644
index 0000000000..bdc7147337
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/relayout-nested-with-oof.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1296900">
+<div id="outer" style="columns:1; column-fill:auto; width:333px; height:100px;">
+ <div style="columns:1; column-fill:auto; width:100px; height:50px;">
+ <div style="position:relative;">
+ <div style="position:absolute; padding-left:1px; padding-bottom:10px;"></div>
+ </div>
+ </div>
+</div>
+<script>
+ document.body.offsetTop;
+ outer.style.width = "334px";
+</script>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/relpos-inline-with-abspos-multicol-gets-block-child.html b/testing/web-platform/tests/css/css-multicol/crashtests/relpos-inline-with-abspos-multicol-gets-block-child.html
new file mode 100644
index 0000000000..19a9bdde3a
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/relpos-inline-with-abspos-multicol-gets-block-child.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1308071">
+<div style="columns:2;">
+ <span style="position:relative;">
+ <div style="position:absolute;"></div>
+ </span>
+ <div id="surprise" style="display:none;"></div>
+ <span></span>
+</div>
+<script>
+ document.body.offsetTop;
+ surprise.style.display = "block";
+</script>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/relpos-spanner-with-spanner-child-becomes-regular.html b/testing/web-platform/tests/css/css-multicol/crashtests/relpos-spanner-with-spanner-child-becomes-regular.html
new file mode 100644
index 0000000000..0f6f66557d
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/relpos-spanner-with-spanner-child-becomes-regular.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1333166">
+<div style="columns:2;">
+ <div id="trouble" style="column-span:all; position:relative;">
+ <div style="column-span:all;"></div>
+ </div>
+ <div></div>
+</div>
+<script>
+ document.body.offsetTop;
+ trouble.style.columnSpan = "none";
+ trouble.style.position = "static";
+</script>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/remove-spanner-after-spanner-in-inline-before-inline.html b/testing/web-platform/tests/css/css-multicol/crashtests/remove-spanner-after-spanner-in-inline-before-inline.html
new file mode 100644
index 0000000000..0836ef1a91
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/remove-spanner-after-spanner-in-inline-before-inline.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1308253">
+<style>
+ #mc { columns: 2; }
+ #mc div { column-span: all; }
+</style>
+<div id="mc">
+ <span><div></div></span><div id="removeme"></div><span id="removemetoo"></span><div></div>
+</div>
+<script>
+ document.body.offsetTop;
+ removeme.style.display = "none";
+ document.body.offsetTop;
+ removemetoo.style.display = "none";
+</script>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/remove-spanner-in-table-caption-nested-multicol.html b/testing/web-platform/tests/css/css-multicol/crashtests/remove-spanner-in-table-caption-nested-multicol.html
new file mode 100644
index 0000000000..21d8a7ee8c
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/remove-spanner-in-table-caption-nested-multicol.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1379635">
+<div style="columns:1;">
+ <div style="columns:2; display:table-caption;">
+ <div style="width:10px;">
+ <div style="height:100px;">
+ <div style="height:1px;"></div>
+ <div style="break-before:column;"></div>
+ </div>
+ <div id="e52" style="overflow:hidden; column-span:all;"></div>
+ </div>
+ </div>
+</div>
+<script>
+ document.body.offsetTop;
+ e52.style.display = "none";
+</script>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/repeated-section-in-nested-table-nested-multicol.html b/testing/web-platform/tests/css/css-multicol/crashtests/repeated-section-in-nested-table-nested-multicol.html
new file mode 100644
index 0000000000..e48854a36b
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/repeated-section-in-nested-table-nested-multicol.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1348774">
+<div style="columns:2; column-fill:auto; height:160px; background:yellow;">
+ <div style="display:table;">
+ <div style="display:table;">
+ <div style="contain:size; height:150px;"></div>
+ <div style="display:table-footer-group; break-inside:avoid;">
+ <div style="columns:2;">
+ x AAAAAAAAAAAAAAAAAAAA x
+ </div>
+ </div>
+ </div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/repeated-table-footer-in-caption-nested-multicol.html b/testing/web-platform/tests/css/css-multicol/crashtests/repeated-table-footer-in-caption-nested-multicol.html
new file mode 100644
index 0000000000..d630abe8bb
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/repeated-table-footer-in-caption-nested-multicol.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1354966">
+<div style="columns:2; column-fill:auto; height:100px;">
+ <div style="display:table;">
+ <div style="display:table-caption; columns:2; column-fill:auto; height:50px;">
+ <div style="display:table;">
+ <div style="display:table-footer-group; break-inside:avoid;"></div>
+ </div>
+ </div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/restricted-height-bottom-border-overflow-and-spanner.html b/testing/web-platform/tests/css/css-multicol/crashtests/restricted-height-bottom-border-overflow-and-spanner.html
new file mode 100644
index 0000000000..43c356509c
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/restricted-height-bottom-border-overflow-and-spanner.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1381327">
+<div style="columns:4;">
+ <div style="height:10px; border-bottom:1px solid;">
+ <div style="height:20px; contain:size;"></div>
+ <div style="height:20px; contain:size;"></div>
+ <div style="float:right; width:10px; height:100px;"></div>
+ <div style="column-span:all;"></div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/scrollable-spanner-in-nested.html b/testing/web-platform/tests/css/css-multicol/crashtests/scrollable-spanner-in-nested.html
new file mode 100644
index 0000000000..b904aaddd2
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/scrollable-spanner-in-nested.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1334885">
+<div style="columns:2;">
+ <!-- Add a table, as an attempt to trigger legacy layout fallback. -->
+ <div style="display:table;"></div>
+ <div style="columns:2;">
+ <div style="overflow:scroll; column-span:all;"></div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/size-containment-become-multicol-add-inline-child.html b/testing/web-platform/tests/css/css-multicol/crashtests/size-containment-become-multicol-add-inline-child.html
new file mode 100644
index 0000000000..6933592c7e
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/size-containment-become-multicol-add-inline-child.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1348714">
+<div id="container" style="width:fit-content; container-type:size;">
+ <span></span>
+ <span id="boo" style="display:none;"></span>
+</div>
+<script>
+ document.body.offsetTop;
+ container.style.columnCount = "2";
+ boo.style.display = "inline";
+</script>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/spanner-after-parallel-flow.html b/testing/web-platform/tests/css/css-multicol/crashtests/spanner-after-parallel-flow.html
new file mode 100644
index 0000000000..4ed0914fc7
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/spanner-after-parallel-flow.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1383978">
+<div style="columns:5; height:10px;">
+ <div style="height:0;">
+ <div style="contain:size; height:20px;"></div>
+ <div style="contain:size; height:20px;"></div>
+ <div></div>
+ <div style="break-before:column;"></div>
+ </div>
+ <div>
+ <div style="contain:size; height:20px;"></div>
+ <div style="contain:size; height:20px;"></div>
+ <div style="column-span:all;"></div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/spanner-in-inline-after-very-tall-content-001.html b/testing/web-platform/tests/css/css-multicol/crashtests/spanner-in-inline-after-very-tall-content-001.html
new file mode 100644
index 0000000000..6f3cb5c553
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/spanner-in-inline-after-very-tall-content-001.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1327882">
+<div style="columns:3; orphans:1; widows:2; line-height:20px;">
+ <span>
+ <div style="height:1234567890px;"></div>
+ <br>
+ <div style="display:inline-block; width:100px; height:6000000px;"></div>
+ <div style="column-span:all;"></div>
+ </span>
+ <div id="tallthing" style="height:10000000px;"></div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/spanner-in-inline-after-very-tall-content-002.html b/testing/web-platform/tests/css/css-multicol/crashtests/spanner-in-inline-after-very-tall-content-002.html
new file mode 100644
index 0000000000..0a68ec8288
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/spanner-in-inline-after-very-tall-content-002.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1327882">
+<div style="columns:15;">
+ <span>
+ <div style="height:214748364px;"></div>
+ </span>
+ <br>
+ <div style="display:inline-block; width:100px; height:2147487px;"></div>
+ <span>
+ <div style="column-span:all;"></div>
+ </span>
+ <div style="columns:1; column-fill:auto; height:2147483px;"></div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/spanner-in-overflowed-clipped-container.html b/testing/web-platform/tests/css/css-multicol/crashtests/spanner-in-overflowed-clipped-container.html
new file mode 100644
index 0000000000..d38c7b6f08
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/spanner-in-overflowed-clipped-container.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1377576">
+<div style="columns:2;">
+ <div style="overflow:clip; height:15px;">
+ <div style="height:20px;"></div>
+ <div style="column-span:all;"></div>
+ <div></div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/spanner-in-overflowed-container-before-float.html b/testing/web-platform/tests/css/css-multicol/crashtests/spanner-in-overflowed-container-before-float.html
new file mode 100644
index 0000000000..c15d8aa0fa
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/spanner-in-overflowed-container-before-float.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1309859">
+<div style="columns:2; column-fill:auto; height:400px;">
+ <div style="height:10px;"></div>
+ <div style="height:20px;">
+ <div style="display:inline-block; width:10px; height:50px;"></div>
+ <div>
+ <div style="column-span:all;"></div>
+ </div>
+ </div>
+ <div style="columns:2; height:100px; float:left;"></div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/spanner-in-overflowed-container-before-inline-content.html b/testing/web-platform/tests/css/css-multicol/crashtests/spanner-in-overflowed-container-before-inline-content.html
new file mode 100644
index 0000000000..8fba171e25
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/spanner-in-overflowed-container-before-inline-content.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1314998">
+<div style="columns:10; height:100px; column-fill:auto; line-height:20px; orphans:1; widows:1;">
+ <div style="height:0; padding-bottom:100px;">
+ <div style="height:350px;"></div>
+ <div style="column-span:all; padding-bottom: 100px;"></div>
+ </div>
+ <div style="width:1px;">
+ <br>
+ <div style="display:inline-block; columns:2; height:100px; column-fill:auto;"></div>
+ x
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/spanner-inside-inline-in-overflowed-container.html b/testing/web-platform/tests/css/css-multicol/crashtests/spanner-inside-inline-in-overflowed-container.html
new file mode 100644
index 0000000000..d53d295271
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/spanner-inside-inline-in-overflowed-container.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1393887">
+<div style="columns:3; column-rule:solid; line-height:20px;">
+ <div style="height:15px;">
+ <br><br><br><br><br><br>
+ <span>
+ <div style="column-span:all; height:10px;"></div>
+ </span>
+ </div>
+ <div style="height:100px;"></div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/specified-height-with-just-spanner-and-oof.html b/testing/web-platform/tests/css/css-multicol/crashtests/specified-height-with-just-spanner-and-oof.html
new file mode 100644
index 0000000000..3c4d51b0f4
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/specified-height-with-just-spanner-and-oof.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1296897">
+<div style="columns:2; column-fill:auto; height:100px;">
+ <div style="column-span:all;"></div>
+ <div style="position:absolute;"></div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/sticky-in-abs-in-sticky.html b/testing/web-platform/tests/css/css-multicol/crashtests/sticky-in-abs-in-sticky.html
new file mode 100644
index 0000000000..961b4fc2bb
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/sticky-in-abs-in-sticky.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1224888">
+<div style="columns:2; column-fill:auto; height:100px;">
+ <div style="position:sticky; left:0;">
+ <div style="position:absolute;">
+ <div style="break-after:column;"></div>
+ <div style="position:sticky; backface-visibility:hidden; left:0; width:100px; height:100px;"></div>
+ </div>
+ </div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/table-caption-change-descendant-display-type.html b/testing/web-platform/tests/css/css-multicol/crashtests/table-caption-change-descendant-display-type.html
new file mode 100644
index 0000000000..c44fcca5ac
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/table-caption-change-descendant-display-type.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1347713">
+<div style="columns:2;">
+ <div style="display:table-caption; columns:2;">
+ <div style="columns:2;">
+ <div style="position:relative;">
+ <div id="foo" style="position:absolute;"></div>
+ </div>
+ </div>
+ </div>
+</div>
+<script>
+ document.body.offsetTop;
+ foo.style.display = "flex";
+</script>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/table-caption-inline-block-remove-child.html b/testing/web-platform/tests/css/css-multicol/crashtests/table-caption-inline-block-remove-child.html
new file mode 100644
index 0000000000..721f1e8889
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/table-caption-inline-block-remove-child.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1347868">
+<div style="columns:2; column-fill:auto; height:500px;">
+ <table>
+ <caption>
+ <div style="display:inline-block;">
+ <div style="writing-mode:vertical-lr;">
+ <div id="elm" style="display:inline-block;"></div>
+ <div style="display:inline-block; overflow:auto;"></div>
+ </div>
+ </div>
+ </caption>
+ </table>
+</div>
+<script>
+ document.body.offsetTop;
+ elm.style.display = "none";
+</script>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/table-cell-writing-mode-root.html b/testing/web-platform/tests/css/css-multicol/crashtests/table-cell-writing-mode-root.html
new file mode 100644
index 0000000000..394989e009
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/table-cell-writing-mode-root.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1174687">
+<div style="display:table-cell; writing-mode:vertical-lr; columns:2;">
+ <span id="surprise" style="display:none;">x</span>
+</div>
+<script>
+ document.body.offsetTop;
+ surprise.style.display = "inline";
+</script>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/trailing-parent-padding-between-spanners.html b/testing/web-platform/tests/css/css-multicol/crashtests/trailing-parent-padding-between-spanners.html
new file mode 100644
index 0000000000..ffd1002177
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/trailing-parent-padding-between-spanners.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1310489">
+<div style="columns:2;">
+ <div style="padding-bottom:12px;">
+ <div style="column-span:all;"></div>
+ </div>
+ <div style="column-span:all;"></div>
+ <div></div>
+</div>
diff --git a/testing/web-platform/tests/css/css-multicol/crashtests/vertical-rl-column-rules-wide-columns.html b/testing/web-platform/tests/css/css-multicol/crashtests/vertical-rl-column-rules-wide-columns.html
new file mode 100644
index 0000000000..22eb9d56b6
--- /dev/null
+++ b/testing/web-platform/tests/css/css-multicol/crashtests/vertical-rl-column-rules-wide-columns.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1308191">
+<div style="columns:1; writing-mode:vertical-rl; column-rule:solid; column-fill:auto; block-size:100px;">
+ <div style="inline-size:1234567890px; block-size:500px;"></div>
+</div>