url-format-non-string.html | Explore in Territory

<html>
  <head>
    <script>
      if (window.testRunner)
        testRunner.dumpAsText();
    </script>

    <style media="all" type="text/css">
      body {
        src: url() format(attr(r));
      }
    </style>
  </head>
    <!-- This previously triggered the use of uninitialised memory. Thanks to
         Robert Swiecki for the test case. -->
    <p>PASS</p>
  <body>
  </body>
</html>

chromium/Noneurl-format-non-string.html