chromium/third_party/blink/web_tests/images/size-failure.html

<html>
<head>
<script>
if (window.testRunner) {
  testRunner.dumpAsText();
  testRunner.waitUntilDone();
}

window.onload = function() {
  if (!window.testRunner)
    return;
  // Force a full lifecycle update to cover rasterization issues if any.
  testRunner.updateAllLifecyclePhasesAndCompositeThen(function() {
    testRunner.notifyDone();
  });
};
</script>
</head>
<body>
  <!-- This previously tried to read the size of the image when
       ImageDecoder::m_failed was true, triggering either an assert or a
       read of random memory. Thanks to Robert Swiecki for the test case. -->
  <img src="resources/size-failure.gif">
  <p>PASS</p>
</body>
</html>