chromium/third_party/blink/web_tests/css3/filters/crash-filter-change.html

<!DOCTYPE html>
<!-- Test passes if doesn't crash. -->
<style>
.first {
    filter: hue-rotate(90deg);
}
.second {
    filter: blur(3px);
}
</style>
<img class='first' src="resources/reference.png">
<script>
    // force a layout
    document.body.offsetTop;
    var img = document.getElementsByTagName('img')[0];
    img.className = 'second';
</script>