chromium/third_party/blink/web_tests/virtual/text-antialias/title-crash.html

<style>*{font-style:italic;font-size:1ex;}</style>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();
    document.documentElement.innerHTML = '<title>a</title>This test passes if it does not crash.'
</script>