<html>
  <head>
    <script>
      if (window.testRunner) {
        testRunner.waitUntilDone();
        testRunner.dumpAsText();
      }

      function testPassed()
      {
        document.getElementById("result").innerText = "PASS";
        if (window.testRunner)
          testRunner.notifyDone();
      }
    </script>

   </head>
   <body>
     <!-- This previously tried to recursively decode the PNG, leading to heap
          corruption when trying to unwind the stack through a member of a
          destroyed object. -->
     <img src="resources/bad-png.png" onerror="testPassed()">
     <p id="result">FAIL</p>
   </body>
 </html>