chromium/third_party/blink/web_tests/virtual/text-antialias/chromium-linux-fallback-crash.html

<html>
  <script>
    if (window.testRunner)
      testRunner.dumpAsText();
  </script>

  <body>
    <p>Previously this would crash Chromium Linux by triggering a NULL pointer dereference in the font fallback code.</p>

    <span style="font-family: -webkit-family-will-not-be-found;">Foo</span>
  </body>
</html>