chromium/third_party/blink/web_tests/fast/css/parse-timing-function-crash.html

<p style="-webkit-transition-timing-function: cubic-bezier(0.5, 0.2, 0.8, 0.9);">This paragraph has a -webkit-transition-timing-function property that uses the cubic-bezier function. Parsing its style should not cause the browser to crash.</p>
<script>
if (window.testRunner)
    testRunner.dumpAsText();
</script>