chromium/third_party/blink/web_tests/fast/reflections/reflected-img-crash.html

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
   "http://www.w3.org/TR/html4/loose.dtd">

<html lang="en">
<head>
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
  <title>Reflections</title>
  <style type="text/css" media="screen">

    img {
      position: absolute;
      height: 100px;
      width: 200px;
      border: 1px solid black;
      -webkit-box-reflect: below;
    }
    
    img.unreflected {
      -webkit-box-reflect: none;
    }

  </style>
  <script type="text/javascript" charset="utf-8">
    
    if (window.testRunner)
      testRunner.dumpAsText();

    function runTest()
    {
      var image = document.getElementById('image');
      image.className = 'unreflected';
    }
    
    window.addEventListener('load', runTest, false);
  </script>
</head>
<body>

  <p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=28289">https://bugs.webkit.org/show_bug.cgi?id=28289</a>. Should not crash.</p>
  <img id="image">

</body>
</html>