From code search suspecting the below.
Suspect : https://codereview.chromium.org/2366153002
dcheng@ : Could you please take a look into this if its related to your change,else please help assigning to an appropriate owner for this.
Currently its impacting to Head.

That CL didn't touch any source files. I don't think anything in this particular area has changed recently, nor do I see any particularly suspicious CLs in that blame range (none are layout related).

Someone from the layout team should triage this, I guess columnSetToRemove is null somehow.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d97ab241d0580e1a2478e07963faa0b1f0004c9b

commit d97ab241d0580e1a2478e07963faa0b1f0004c9b
Author: mstensho <mstensho@opera.com>
Date: Fri Nov 04 20:39:03 2016

Descendants may become or cease to be spanners when an ancestor changes style.

When building the tree, when inserting something that looks like a
column spanner, we first examine all the parents all the way up to the
multicol container, to make sure that they are all valid spanner
containers. This already works fine.

In our implementation, a valid column spanner container is, roughly, a
"regular" in-flow block. Among other things, it may not establish a
new block formatting context. Nor transforms. And a few other
things.

If the style of a valid column spanner container changes, it may end
up as no longer being a valid spanner container, and vice versa: an
invalid spanner container may become a valid spanner container, all of
a sudden.

Detect this during style change. If a block ceases to be a valid
spanner container, we need to check its subtree for spanners, and turn
them into regular column content. And, vice versa, if a block is
turned into a valid spanner container, we need to check its subtree
for column-span:all objects, which may have to be changed from regular
column content into spanners.

BUG= 661761 

Review-Url: https://codereview.chromium.org/2479873002
Cr-Commit-Position: refs/heads/master@{#430005}

[add] https://crrev.com/d97ab241d0580e1a2478e07963faa0b1f0004c9b/third_party/WebKit/LayoutTests/fast/multicol/dynamic/former-spanner-in-float-in-continuation-crash.html
[add] https://crrev.com/d97ab241d0580e1a2478e07963faa0b1f0004c9b/third_party/WebKit/LayoutTests/fast/multicol/dynamic/invalid-spanner-container-becomes-valid.html
[add] https://crrev.com/d97ab241d0580e1a2478e07963faa0b1f0004c9b/third_party/WebKit/LayoutTests/fast/multicol/dynamic/valid-spanner-container-becomes-invalid.html
[modify] https://crrev.com/d97ab241d0580e1a2478e07963faa0b1f0004c9b/third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp
[modify] https://crrev.com/d97ab241d0580e1a2478e07963faa0b1f0004c9b/third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.h

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot