chromium/third_party/blink/web_tests/paint/masks/option-select-mask-crash.html

<!doctype HTML>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
Passes if it does not crash.
<select multiple="multiple">
  <option style="backface-visibility: hidden;
               -webkit-mask-box-image-source: url(#test);
               display: table-header-group; "></option>
</select>
<script>
    test(function() {})
</script>