bad-png.html | Explore in Territory

<html>
  <head>
    <script>
      if (window.testRunner)
        testRunner.dumpAsText();
    </script>

   </head>
   <body>
     <!-- This previously tried to recursively decode the PNG, leading to heap
          corruption when trying to unwind the stack through a member of a
          destroyed object. -->
     <img src="resources/bad-png.png">
     <p>PASS</p>
   </body>
 </html>

chromium/third_party/blink/web_tests/images/bad-png.html