crash-allocating-very-large-raster-shape.html

<!-- Without the the associated fix, crashes only in Win 32 ASAN. -->
<!-- The exact width of the column also matters. -->
<script>
  if (window.testRunner) {
    testRunner.dumpAsText();
  }
</script>
<style>
  * {
    /* Margin size is important. Just enough to crash but not enough to hit
       the check for "too big to allocate an image"
    */
    margin: 41310px auto 90 auto; 
    shape-outside: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg'></svg>");
  }
</style>
<body style="column-width:24em; column-gap:2em">
  <div style="float:left;">
    <div>A
      <p>B
        <p>C
          <p>D
            <p>E
              <p>F
                <p>G
                  <p>H
                    <p>I
                      <p>KKKKKKKKKKKKKKKKKKKKKKKKK
                        <p>L
                          <p>M
                          </p>
                        </p>
                      </p>
                    </p>
                  </p>
                </p>
              </p>
            </p>
          </p>
        </p>
      </p>
    </div>
  </div>
</body>

chromium/third_party/blink/web_tests/fast/shapes/crash-allocating-very-large-raster-shape.html