chromium/third_party/blink/web_tests/fast/reflections/toggle-reflection-crash.html

<!DOCTYPE html>

<html>
<head>
<script>
  var reflectionOn = true;
  function toggleReflection() {
    reflectionOn = !reflectionOn;
    var box = document.getElementById('box');
    box.style.webkitBoxReflect = reflectionOn ? 'below' : 'none';
  };

  function finishTest() {
    toggleReflection();
    if (window.testRunner)
      testRunner.notifyDone();
  };

  function startTest() {
    if (window.testRunner) {
      testRunner.waitUntilDone();
      testRunner.dumpAsText();
    }
    toggleReflection();
    window.setTimeout(function() { finishTest(); }, 0);
  };

  window.addEventListener('load', startTest, false);

</script>
</head>

<body>
  <p>This test should not crash when run with Address Sanitizer.</p>
  <div id="box" style="-webkit-box-reflect: below;"</div>
</body>
</html>