chromium/third_party/blink/web_tests/fast/canvas-api/canvas-toDataURL-jpeg-crash.html

<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>

<canvas><canvas id="canvas" width="2000" height="2000"></canvas>
<script>
test(function() {

    var test = document.getElementById('canvas').toDataURL('image/jpeg');

}, "canvas.toDataURL('image/jpeg') should not crash. (https://bugs.webkit.org/show_bug.cgi?id=69681)"); 
</script>