chromium/third_party/blink/web_tests/fast/shapes/shape-outside-floats/shape-outside-floats-margin-crash.html

<!DOCTYPE html>
<html>  
<style>
#wrapped-text {
    font-size: 30px;
    line-height: 1;
}

#image-valued-shape {
    -webkit-shape-outside: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' width='100px' height='100px'><rect x='0' y='0' width='100' height='100' fill='green'/></svg>");
    margin: 30px;
    float: left;
    width: 100px;
    height: 100px;
    background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' width='100px' height='100px'><rect x='0' y='0' width='100' height='100' fill='green'/></svg>");
    background-repeat: no-repeat;
}
</style>
<body>
  <p>The A-C text should appear above and then to the right of the green rectangle. This test should not crash.</p>
  <div id="wrapped-text">
    <div id="image-valued-shape"></div>A<br>B<br>C
  </div>
</body>
</html>