chromium/third_party/blink/web_tests/tables/invalid-background-url-crash.html

<script src="../resources/testharness.js"></script>
<script src="../resources/testharnessreport.js"></script>

<body onload="window.open()">
  <table background="http://tLayp%e3s&quot;^1"></table>
</body>

<script>
if (window.testRunner)
  testRunner.setPopupBlockingEnabled(false);
test(() => {}, 'This test passes if it does not crash.');
</script>