chromium/third_party/blink/web_tests/images/png-extra-row-crash.html

<html>
  <head>
    <script>
    if (window.testRunner)
        testRunner.dumpAsText();
    function loaded()
    {
        var p = document.createElement("p");
        p.appendChild(document.createTextNode("PASS"));
        document.body.appendChild(p);
    }
    </script>
  </head>
  <body>
    The following PNG will attempt to render a bad row.
    If the test succeeds this should not crash.
    <img onload="loaded()" src="resources/png-extra-row-crash.png">
  </body>
</html>