Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/fast/dynamic/crash-generated-image.html 

<html>
    <body>
        <style>
            div:before
            {
                content: url(resources/greenbox.png);
                display: block;
                overflow: hidden;
                width: 100;
                height: 100;
            }
        </style>
        Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=61411">61411</a>: ASSERTION FAILED: !m_layoutRoot->container() || !m_layoutRoot->container()->needsLayout() with generated content<br>
        Test passes if it does not crash.
        <script>
            if (window.testRunner)
                testRunner.dumpAsText();

            document.body.offsetTop;
        </script><div></div>
    </body>
</html>