LayoutTests/fast/images/style-access-during-imageChanged-crash.html

<style>
    @font-face {
      font-family: test;
      src: url(data:text/plain,1);
    }
</style>
<p>
    This test passes if it does not cause an assertion failure or a crash.
</p>
A <img id="target" alt="A">
<script>
    function test()
    {
        document.body.offsetTop;
        document.body.style.fontFamily="test";
        document.body.offsetTop;
        document.getElementById("target").src = "data:text/plain,2";
    }

    if (window.testRunner)
        testRunner.dumpAsText();

    test();
</script>