chromium/third_party/blink/web_tests/fast/reflections/pending-reflection-mask-crash.html

<style>
  *{
    -webkit-box-reflect: none !important;
    -webkit-box-reflect: below 0 url(x);
  }
</style>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();
</script>
<p>This test should not crash.</p>