image-load-event-crash.html | Explore in Territory

<!DOCTYPE html>
<head>
<style>
img {
    background-image: url("data:image/svg+xml,<svg></svg>");
}
</style>
<script>
function changeStyleAndLayout() {
    document.body.style.height = '100px';
    var forceLayout = document.body.offsetWidth;
    if (window.testRunner)
        testRunner.dumpAsText();
}
</script>
</head>
<body>
    Test for crbug.com/248843: This test passes if it does not crash.<br/>
    <img onload="changeStyleAndLayout()" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg==">
</body>
</html>

chromium/third_party/blink/web_tests/images/image-load-event-crash.html