link-body-content-imageDimensionChanged-crash.html

<!DOCTYPE html>
<html>
<head>
<style>
div {
    content: url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAA8AAAAPAQMAAAABGAcJAAAAA1BMVEUAgACc+aWRAAAADElEQVR42mNgIAEAAAAtAAH7KhMqAAAAAElFTkSuQmCC");
    padding-bottom: 10581%;
}
 </style>
<script>
if (window.testRunner)
    testRunner.dumpAsText();
</script>
</head>
<p> Bug <a href="http://webkit.org/b/85912">85912</a>: Crash in computedCSSPadding* functions due to LayoutImage::imageDimensionsChanged called during attachment</p>
<p> This test PASSED if it did not crash. </p>
<div>
    <link href="inexistant.css" rel=stylesheet>
    <body style='content: "PASSED, no crash"; '></body>
</div>
</html>

chromium/third_party/blink/web_tests/images/link-body-content-imageDimensionChanged-crash.html