Predator and CL did not provide any possible suspects.
Using Code Search for the file, "LayoutMultiColumnSet.cpp" assigning to the concern owner.

Suspecting commit#
https://chromium.googlesource.com/chromium/src/+/ed375c02e956ef832e8ed6223435f0d78d6bdf77

@dcheng -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

This is not my CL. Passing this off to mstensho@opera.com

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/079f4500332799e2e3e03eb15243b1b8d5342fe6

commit 079f4500332799e2e3e03eb15243b1b8d5342fe6
Author: mstensho <mstensho@opera.com>
Date: Fri May 12 05:57:52 2017

Improve LayoutMultiColumnFlowThread::IsPageLogicalHeightKnown().

Simply returning whether the last column set has a known height isn't really
sufficient. All column sets need to have known heights.

However, instead of asking each column set every time we call
LayoutMultiColumnFlowThread::IsPageLogicalHeightKnown(), use a flag.

BUG=709792, 717939 

Review-Url: https://codereview.chromium.org/2877703003
Cr-Commit-Position: refs/heads/master@{#471231}

[add] https://crrev.com/079f4500332799e2e3e03eb15243b1b8d5342fe6/third_party/WebKit/LayoutTests/fast/multicol/span/float-with-overflow-before-spanner-crash.html
[modify] https://crrev.com/079f4500332799e2e3e03eb15243b1b8d5342fe6/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
[modify] https://crrev.com/079f4500332799e2e3e03eb15243b1b8d5342fe6/third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp
[modify] https://crrev.com/079f4500332799e2e3e03eb15243b1b8d5342fe6/third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.h

ClusterFuzz has detected this issue as fixed in range 471219:471233.

Detailed report: https://clusterfuzz.com/testcase?key=6185261930381312

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: Floating-point-exception
Crash Address: 
Crash State:
  IntMod
  blink::LayoutMultiColumnSet::PageRemainingLogicalHeightForOffset
  AdjustedMarginBeforeForPagination
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=449250:449265
Fixed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=471219:471233

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6185261930381312


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.