After changing column-balancing behavior in bug 1647332, layout/generic/crashtests/468207-1.html triggers some assertions on windows like:

[Child 3224, Main Thread] ###!!! ASSERTION: Frame region deletion was requested but we couldn't delete it: '!frameSet.Contains(mFloats[i].mFrame)', file /builds/worker/checkouts/gecko/layout/generic/nsFloatManager.cpp, line 376
#01: nsBlockFrame::CheckFloats(mozilla::BlockReflowInput&) [layout/generic/nsBlockFrame.cpp:7512]
#02: nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) [layout/generic/nsBlockFrame.cpp:1484]
#03: nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) [layout/generic/nsContainerFrame.cpp:1078]
#04: nsColumnSetFrame::ReflowChildren(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig const&, bool) [layout/generic/nsColumnSetFrame.cpp:706]
#05: nsColumnSetFrame::FindBestBalanceBSize(mozilla::ReflowInput const&, nsPresContext*, nsColumnSetFrame::ReflowConfig&, nsColumnSetFrame::ColumnBalanceData, mozilla::ReflowOutput&, bool, nsReflowStatus&) [layout/generic/nsColumnSetFrame.cpp:1110]
#06: nsColumnSetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) [layout/generic/nsColumnSetFrame.cpp:1244]