third_party/WebKit/LayoutTests/fast/text/title-crash.html

<style>*{font-style:italic;font-size:1ex;}</style>
<script>
    if (window.testRunner)
        window.testRunner.dumpAsText();
    document.documentElement.innerHTML = '<title>a</title>This test passes if it does not crash.'
</script>