chromium/third_party/blink/web_tests/fast/replaced/css-content-and-webkit-mask-box-image-crash.html

<script>
    if (window.testRunner)
        testRunner.dumpAsText();

    function insertSpan() {
        document.getElementById("container").innerHTML = "<span style=\"content:url('resources/compass.jpg'); -webkit-mask-box-image:url('resources/compass.jpg');\">FAIL</span>";
    }
</script>
<body onload="insertSpan()">
    The test passes if you see the Safari icon below.
    <div id="container"></div>
    <script>
        insertSpan();
    </script>
</body>