chromium/third_party/blink/web_tests/fast/shapes/shape-outside-floats/shape-outside-floats-shape-margin-crash.html

<!DOCTYPE html>
<style>
div {
    width: 5px;
    height: 5px;
    margin-top: 2px;
    shape-margin: 2px;
    shape-outside: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' width='5' height='5'><rect x='0' y='0' width='100%' height='100%'/></svg>");
    float:left;
}
</style>                         
<script>
    if (window.testRunner)
        testRunner.dumpAsText();
</script>
<body>
    <div></div>
    This test should not crash in a debug build.
</body>