Based on code search and recent change made to the file "LayoutMultiColumnFlowThread.cpp" suspecting the below.
Review-Url: https://codereview.chromium.org/2725943003
mstensho@: Could you please take a look into this if its related to your change.

Not introduced by that CL, but this one is mine, all right.

ClusterFuzz has detected this issue as fixed in range 455565:456161.

Detailed report: https://clusterfuzz.com/testcase?key=5579489594834944

Fuzzer: bj_broddelwerk
Job Type: linux_debug_chrome
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !m_columnSetsInvalidated in LayoutMultiColumnFlowThread.cpp
  blink::LayoutMultiColumnFlowThread::columnSetAtBlockOffset
  blink::LayoutMultiColumnFlowThread::appendNewFragmentainerGroupIfNeeded
  
Sanitizer: address (ASAN)

Fixed: https://clusterfuzz.com/revisions?job=linux_debug_chrome&range=455565:456161

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv94QgZUE-4ObPrqmVPwo5AtFhv9e_uaKFLpp8iEvI-kYIgcLC2ZHTPn0rbW1_6veCMw_kTFFiYvdejFfuRiyMml1LKl7-SQZG4qjMIfgLNjY-esHvi4OvG8WebKGS3ihJZp-wf56oSf0POcTqv-X7oxP_CDR4jUdFKcyGXR8Q66BK_cIl_WWko1xpmVWNaTPoI_yPC27HnPr9hdKOo1zoGNCT9iuOfsZAly3IUyRCnlgnjSDjXpJ0PFyNrs-XCb_-XpQKaN-zCQavkXiHgRT7H0X1kv6uHt3vDfzfAa4A2sRvpIzX3QkCDhV4K3cdsBXGCedmA5JxsP-bVWffHTdJsgmOWZH7iSMF_D3o2f5cS55frR1-68?testcase_id=5579489594834944


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5579489594834944 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/bfc4d20f79563dd15832c9f77a4cb916476f3b7c

commit bfc4d20f79563dd15832c9f77a4cb916476f3b7c
Author: mstensho <mstensho@opera.com>
Date: Wed Mar 15 19:58:35 2017

Strictly unbreakable objects need to prevent interaction with the outside.

A strictly unbreakable object (i.e. when getPaginationBreakability() ==
ForbidBreaks) has no valid break points inside. This is the case for e.g.
images, writing mode roots and scrollable objects. If such an object is in the
containing block chain between two nested multicol containers, column content
in multicol containers on the inside shouldn't interact with columns in the
enclosing multicol container.

BUG= 698686 

Review-Url: https://codereview.chromium.org/2748973002
Cr-Commit-Position: refs/heads/master@{#457177}

[add] https://crrev.com/bfc4d20f79563dd15832c9f77a4cb916476f3b7c/third_party/WebKit/LayoutTests/fast/multicol/nested-inside-unbreakable-crash.html
[modify] https://crrev.com/bfc4d20f79563dd15832c9f77a4cb916476f3b7c/third_party/WebKit/Source/core/layout/LayoutFlowThread.cpp
[modify] https://crrev.com/bfc4d20f79563dd15832c9f77a4cb916476f3b7c/third_party/WebKit/Source/core/layout/LayoutFlowThread.h
[modify] https://crrev.com/bfc4d20f79563dd15832c9f77a4cb916476f3b7c/third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp
[modify] https://crrev.com/bfc4d20f79563dd15832c9f77a4cb916476f3b7c/third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.h