<html>
<head><style>
/* Sets of heights that trigger crash:
    100px/50px/51+px
    100px/30px/74+px
   Get only an assert unless you set ".d { position: absolute; }".
   
   Trigger hang (separate issue, absolute not needed):
    10px/10px/9999px
    10px/10px/999999px --> "bad height" notreached
*/
#colset { width: 200px;
          -moz-column-count: 3; }
#a      { height: 100px;        }
#b      { height:  50px;        }
#c      { height:  51px;        }
#d      { position: absolute;   }
</style>
<script>
  function boom() {
    document.getElementById('a').style.height = 'auto';
  }
</script>
</head>
<!-- Removing whitespace in body for simpler frame trees -->
<body onload="setTimeout('boom()', 1000)"
 ><div id="colset"
   ><div
     ><div id="a"></div
     ><div id="b"
       ><div id="c"></div
       ><div id="d"></div
     ></div
   ></div
 ></div
></body>
</html>