chromium/third_party/blink/web_tests/external/wpt/css/css-inline/too-big-line-height-crash.html

<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<style>
FORM {
  line-height: 404875491%;
}

* {
  position: fixed;
  block-size: 2984941683%;
}
</style>
<script>
addEventListener("DOMContentLoaded", () => {
  getSelection().collapse(
    document.body.lastChild,
    document.body.lastChild.length
  );
}, {once: true});
</script>
</head>
<form contenteditable>
    <li style="marker-mid: url(a.svg) !important;
               will-change: contents;
               writing-mode: vertical-lr !important;
               shape-outside: none"></li>
</form>
</body></html>